Privacy Policy

Information on the processing of personal data pursuant to Article 13 of EU Regulation 679/16 (GDPR), in effect since May 24, 2016 – applicable from May 25, 2018. Where applicable, reference is also made to Legislative Decree 196/2003 (Code regarding the protection of personal data, also known as the Privacy Code), as amended by Legislative Decree 101/2018.

1. Applicable regulations

   *** Dear user, registration on the site is optional and allows access to certain specific sections of the Site and to take advantage of various services. The processing of personal data is always based on principles of lawfulness and fairness in compliance with all applicable regulations. In particular, we respect the principles of privacy by design and privacy by default. Below you will find all the details regarding the processing of your personal data. We are available to answer your questions and/or requests. Remember that you can modify your profile independently by accessing your account in the “my account” section or delete it by sending a simple email requesting account deletion to: servizioclienti@angelmercatone.com

1. 1. Data controller

   This information notice is prepared pursuant to Article 13 of EU Regulation 679/16 (GDPR) by Angel Mercatone Due S.r.l., Via Tosarelli, 280 (40055) Villanova di Castenaso (BO) VAT number 03248671202 Share capital € 550,000.00 fully paid. REA: BO-503837 (Angel Mercatone), in relation to the personal data provided by users (data subjects) when accessing and/or registering on the website www.angelmercatone.it (Site) or purchasing the products offered for sale on it. Angel Mercatone Due S.r.l. is the Data Controller. The Data Controller can be contacted by the data subject at the email address servizioclienti@angelmercatone.com; PEC: angelmercatone2@pec.it; or by registered mail at the above address.

2. 2. Legal basis for processing, Purpose of processing, and Nature of the data processed.

   The legal basis is the consent of the Data Subject to communicate their data in order to allow the Data Controller to fulfill the services indicated herein, as well as the legitimate interest of the Data Controller (Recital 47 GDPR). Angel Mercatone will process the personal data provided by users for the following purposes:

   a)to allow registration on the Site and to use the services reserved for registered users, as well as to make purchases of the products offered for sale online on the Site and, therefore, to allow the conclusion of the purchase contract and the correct execution of the related operations;

   b)for administrative and accounting purposes related to registration on the Site;

   c)with the user's prior express consent, for the sending, by Angel Mercatone, of informative and promotional communications (including the newsletter) related to the products offered for sale on the Site as well as for conducting market research aimed at assessing user satisfaction (customer satisfaction), via email and/or postal service (so-called “marketing” purposes);

   d)with the user's prior express consent, for the analysis of their consumption choices and purchasing habits (so-called “profiling”), by Angel Mercatone through the detection of the type and frequency of purchases made online for the purpose of sending informative and/or advertising material of specific interest to the user in the manner described in "point c)" above;

   e)limited to the email address provided by the user in the context of purchasing a product offered on the Site, to allow the direct sale of similar products without the need for the user's prior express consent (as provided for by Article 130, paragraph 4 of the Privacy Code) and provided that the user does not exercise the right to object in the manner described in Article 3 that follows (so-called “soft spamming”).

   - 7Pixel S.r.l., represented by the legal representative pro tempore, is appointed as the Data Controller of the User's data (specifically, the email address) for managing comment requests within the Trusted Program of the website www.trovaprezzi.it. Other parties that Angel Mercatone needs to contact for the performance of its activities (including, for example, the online review service TrustPilot) are similarly appointed as Data Controllers. Sensitive or judicial data of users are not subject to processing by Angel Mercatone. Angel Mercatone will retain, within the legal terms, the log files and IP addresses used during an online purchase to prevent and ascertain any fraud in online transactions.

3. 3. Provision of data and consequences in case of lack of consent to processing

   The provision of personal data not marked as mandatory is purely optional, and the failure to provide, partially provide, or inaccurately provide such Personal Data does not have any consequences, except for those expressly indicated below. The failure to provide, partially provide, or inaccurately provide personal data otherwise marked as mandatory will make it impossible to execute the service you requested.

   The provision of data for the purposes referred to in points (a) and (b) of the preceding article 2 is purely optional. However, since this processing is necessary to allow registration on the Site and to carry out the online purchase service, the user's possible refusal to provide the requested data will result in the inability to register on the Site and to complete the online purchase.

   With reference to the purposes of processing referred to in points (c) (so-called "marketing" purposes) and (d) (so-called "profiling" purposes) of Article 2 above, consent to the processing of personal data is purely optional. The lack of consent will not have any consequences on the possibility of registering on the Site and/or making purchases on it and will only imply the consequences described below:

   – the lack of consent to the processing of personal data for the purposes referred to in Article 2, letter (c) above (so-called "marketing" purposes) will result in the inability to receive, from Angel Mercatone, informative and promotional communications (including the newsletter) related to the products offered for sale on the Site;

   – the lack of consent to the processing of personal data for the purposes referred to in Article 2, letter (d) above (so-called "profiling" purposes) will result in Angel Mercatone's inability to detect the type and frequency of the user's online purchases in order to send them informative and/or advertising material of specific interest to them.

4. 4. Revocation of Consent

   The user may, in any case, revoke any consent given for marketing and profiling purposes or oppose the processing for the purposes of so-called soft spamming:

   - by contacting Angel Mercatone at the addresses listed in Article 1 above;

   - via a specific link present at the bottom of any promotional email sent by Angel Mercatone. The opposition expressed in this way also extends to the sending of communications by postal service.

   
   

5. 5. Rights of the Data Subject

   Without prejudice to the above, the user may exercise any of their rights among those indicated in Chapter III of the aforementioned Regulation 679/16 (Chapter titled "Rights of the Data Subject"), with particular reference to the rights under Articles 15 and following of the GDPR (for example: right of access; right to rectification and erasure; right to restriction of processing; right to data portability; right to object including profiling and automated data processing). The data subject may assert their rights at any time by contacting Angel Mercatone at the contact details indicated in Article 1 above.

   
   

6. 6. Minors

   Minors under the age of 16 must not provide information or personal data to Angel Mercatone without the consent of those exercising parental responsibility over them. Angel Mercatone encourages all those who exercise parental responsibility over minors to inform them about the safe and responsible use of the Internet and the Web.

7. 7. Scope of data communication

   The personal data provided by the user, for the purposes described in Article 2 above, may be made known to or communicated to the following subjects:

   – employees and/or collaborators of Angel Mercatone, for the performance of administrative, accounting, and IT and logistical support activities who act as data processors and persons in charge of processing;

   – to the company that sends, on behalf of Angel Mercatone, newsletters and other informative communications transmitted on behalf of Angel Mercatone; – to the subjects that manage online payment transactions;

   – to all those public and/or private entities, natural and/or legal persons (legal, administrative, and tax consulting firms), whenever communication is necessary or functional to the correct fulfillment of the contractual obligations undertaken in relation to the services provided through the Site, as well as the obligations arising from the law;

   – to all those entities (including Public Authorities) that have access to the data by virtue of regulatory or administrative provisions; – to shippers and those responsible for the delivery and/or collection of purchased products.

   All personal data provided by users in relation to registration on the Site and/or purchases made through the Site are not subject to dissemination. The updated list of data processors and authorized persons is available at the headquarters of the Data Controller.

8. 8. Data Retention

   User data will be retained only for the time necessary to ensure the proper performance of the services offered.

   In the event of account closure on the Site at the user's initiative, the data contained therein will be retained for administrative purposes for a period not exceeding one quarter, without prejudice to any specific legal obligations regarding the retention of accounting documentation or for public safety purposes.

   Users can always request the deletion of their data, without prejudice to the legal obligations of the Data Controller.

9. 9. Right of Access to Personal Data

   Pursuant to Article 15 of the GDPR, the data subject has the right to obtain from the data controller confirmation as to whether or not personal data concerning them is being processed and, in such case, to obtain access to the personal data and the following information:

   a)the purposes of the processing;

   b)the categories of personal data concerned;

   c)the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular if recipients are in third countries or international organizations;

   d)where possible, the retention period for the personal data or, if not possible, the criteria used to determine that period;

   e)the existence of the data subject's right to request the data controller to rectify or erase personal data or to restrict the processing of personal data concerning them or to object to such processing;

   f)the right to lodge a complaint with a supervisory authority;

   g)if the data are not collected from the data subject, all available information about their source;

   h)the existence of automated decision-making, including profiling as referred to in Article 22, paragraphs 1 and 4 of the GDPR, and, at least in such cases, meaningful information about the logic involved, as well as the significance and the anticipated consequences of such processing for the data subject.

   The data controller provides a copy of the personal data being processed. In the case of further copies requested by the data subject, the data controller may charge a reasonable fee based on administrative costs. If the data subject submits the request electronically, and unless otherwise indicated by the data subject, the information is provided in a commonly used electronic format. The right to obtain a copy must not infringe on the rights and freedoms of others.

   The above rights may be exercised by requesting the Data Controller at the contact details provided in Article 1.

FIDELITY CARD INFORMATION BENEFITS & LOYALTY of POINTS OF SALE

pursuant to Articles 12, 13, and 14 of EU Regulation 2016/679

The loyalty card is a free card voluntarily requested by the Data Subject, which is issued upon completion of the application form, and allows the collection of points by making purchases at the point of sale. The conditions for participating in the loyalty program are made known through communications present at the point of sale and/or on the e-shop accessible by connecting to the website www.angelmercatone.it. The processing of personal data provided by the Data Subject is carried out lawfully, fairly, transparently, and in compliance with the provisions of EU Regulation 2016/679.

1) DATA CONTROLLERis ANGEL MERCATONE DUE S.r.l., with registered office at Via Tosarelli n. 280, 40055, Castenaso (BO), which, with a separate agreement pursuant to Article 28 and following of the GDPR, authorizes this Processor to collect the data and use it for the intended purposes.

2) DATA SUBJECT TO PROCESSINGthey are the personal data of the Data Subject to the extent necessary to allow the issuance of the loyalty card (so-called minimization).

3) LEGAL BASISit is the consent of the Data Subject to communicate their data in order to obtain the loyalty card, as well as the legitimate interest of the Data Controller (Recital 47 GDPR).

4) PURPOSE OF THE PROCESSING: The processing of personal data collected from the Data Subject, or those derived from the analysis of the Data Subject's purchases, is aimed at:

a)issuing the loyalty card and allowing the Data Subject access to the benefits reserved for the holders thereof;

b)improving the commercial offer proposed to customers of the Data Controller's points of sale; of connected or affiliated companies or those in the same group; as well as to customers of the points of sale of the Data Processors; through the use of data derived from the analysis of the consumption habits of the Data Subjects;

c)telemarketing activities and sending, via mail and/or electronic communications (e-mail, sms, mms, etc.) advertising and/or promotional material;

d)telemarketing and/or direct marketing specifically tailored to the spending habits of the Data Subject, derived from the analysis of the relevant data;

e)fulfilling legal obligations of an administrative, tax, and/or accounting nature.

5) RECIPIENTS OF THE COMMUNICATION OF PERSONAL DATA: for the purposes referred to in point 4) of this document, the data of the Data Subject may be communicated, in addition to the Data Controller (ANGEL MERCATONE DUE S.r.l.), to connected or affiliated companies, or to those in which Angel Mercatone Due S.r.l. participates, or to the Data Processors appointed for this purpose; as well as to the Data Protection Officer, if appointed, to collaborators and/or employees authorized by the Data Controller. For the same purposes, the data may be communicated to entities, professionals, companies, public authorities and administrations, and/or other structures responsible for processing related to the fulfillment of legal, administrative, accounting, and management obligations, as well as marketing and communication activities related to the ordinary conduct of the Company's business. The data will be transmitted exclusively within the territory of Italy and within the European Union, in compliance with the obligations mentioned above.

6) DURATION OF PROCESSING: the period ofdata retentioncorresponds to a time not exceeding that necessary for the purposes for which the data was collected or subsequently processed; as well as - unless necessary to comply with legal obligations - until the data subject requests its deletion.

7) NATURE OF DATA COLLECTION: the provision of data is mandatory, limited to the data indicated as such, and requires the consent of the Data Subject in order to allow the Data Controller to issue the loyalty card (point 4) letter a)). Refusal to provide the requested data may result in the inability to proceed with the issuance of the Card. The provision of data not marked as mandatory is optional and requires the consent of the Data Subject in order to allow the Data Controller to pursue the purposes referred to in point 4) letters b)-c)-d). The failure to provide the data indicated as optional will not affect the issuance of the loyalty card.

8) METHODS OF PROCESSING: the data of the Data Subject will be processed primarily in an automated manner, by the Data Controller and the authorized Data Processors, using all appropriate technical and organizational measures to ensure a level of data protection in accordance with the current regulations. With the consent of the Data Subject, and in compliance with the purposes referred to in point 4) letters b), c), d), the data related to purchases will be analyzed in order to understand spending preferences and accordingly adjust the commercial and promotional offer to the specific tastes of the aforementioned, in accordance with the principles of anonymization of the same.

9) RIGHTS OF THE DATA SUBJECT: can be exercised at any time by contacting ANGEL MERCATONE DUE S.r.l, with legal headquarters at Via Tosarelli, 280, and operational headquarters at Via Ca’ Dell’Orbo Sud, 2 – 40055 Villanova di Castenaso (BO) VAT number 03248671202, Tel. 051/0216066, email servizioclienti@angelmercatone.com, PEC angelmercatone@pec.it. The Data Controller is committed to providing a response to the data subject who has exercised any of their rights within 30 days of the exercise of the same. The term may be extended to 3 months in cases of particular complexity, notifying the Data Subject. The Data Subject has the right (Articles 15 et seq. GDPR) to: withdraw their consent; obtain access to their personal data, as well as to obtain rectification and deletion if the conditions are met; obtain restriction of processing; obtain data portability; lodge a complaint with a supervisory authority; as well as to object to processing; not to be subject to a decision based solely on automated processing, including profiling; to be informed in the event of a breach of their data that may pose a high risk to their rights and freedoms.

CODE OF ETHICS OF ANGEL MERCATONE DUE S.R.L. REGARDING WHISTLEBLOWING

Legislative Decree No. 24/2023 implementing the “Whistleblowing” directive (EU Dir. 2019/1937)

Angel Mercatone Due S.r.l., in an effort to remain compliant with regulatory requirements and to protect its employees and stakeholders, has established a specific procedure related to the management of reports and the protection of the confidentiality of whistleblowers. As is known, Legislative Decree No. 24/2023 has systematically addressed the management of reports and the protection of whistleblower confidentiality, implementing the "Whistleblowing" directive (EU Directive 2019/1937), in order to regulate and extend the protection of individuals who report violations. Similarly, the aforementioned Decree has also expanded the scope of reports that can be made, which are not limited to only those offenses relevant under Legislative Decree 231/01, but are also extended to everything provided for in Article 2 of Legislative Decree 24/2023. Furthermore, the Decree stipulates that the entity must have specific internal reporting channels that protect the confidentiality of the whistleblower's identity, which can be structured in both paper and electronic formats. In order to comply with the described regulations, Angel Mercatone Due S.r.l. has established a specific procedure for managing reports, to which reference is made in this context, for anything not specified below. In particular, Angel Mercatone Due has established a specific internal reporting channel, while maintaining the external reporting channel, prepared and managed by ANAC, and the external disclosure, as also provided for by the aforementioned Legislative Decree 24/2023. Specifically, Angel Mercatone Due S.r.l. has decided to implement the following internal reporting channels, with the dual purpose of being compliant with the regulations and effectively providing protective measures for whistleblowers:

I) internal channel for paper reports, consisting of the use of traditional paper mail. In order to ensure the confidentiality required by regulations, the report must be placed in two different sealed envelopes: the first with the identifying information of the reporter along with a photocopy of the identification document; the second with the report, in order to separate the identifying information of the reporter from the report itself. Both must then be placed in a third sealed envelope that bears the label "confidential" on the outside, addressed to the person responsible for receiving the reports (Attorney Massimiliano Baroni) and must be sent to the following address: Modena, 41121, Via dei Servi n. 56;