POLICY FOR PROCESSING OF PERSONAL DATA

MOBILE APP “MOD4” and NEWSLETTER

Pursuant to and by the effect of Article 13 of the European Regulation 2016/679

 

DATA CONTROLLER AND DATA PROTECTION OFFICER

 

  • The Data Controller for personal data is

Avawear S.r.l.

Via Scipione Ammirato, 100

50136, Florence, Italy

Partita IVA 06914900482

info@avawear.it

 

  • DPO (Data Protection Officer)

The Company has named a Data Protection Officer, pursuant to and by the effect of Article 37 and the European Regulation 2016/679.

The Data Protection Officer can be contacted for questions or concerns regarding the processing of personal data and exercising the rights of interested parties at the email:
privacy@avawear.it

 

USING THE MOBILE APP “MOD4”

 

  • Purpose, data processed, legal basis for the processing of your personal data and storage period for the use of the mobile app, data processed.
  1. a) From the moment you create an account we will process this personal data: unique ID generated by us, NICKNAME, EMAIL ADDRESS + ACTIVATION CODE (the latter will be generated by our systems), we will also process the list of profiles that follow you and those followed by you in the MOD4 app + scores obtained in the Challenges; the legal basis for this data processing is the execution of the contract.

It is not mandatory to provide us with this data, but otherwise we will not be able to create the account, however the app will continue to work (in “guest” mode) but only in part, because some functions will not be usable (e.g. messaging).

This data will be deleted from our archives after 24 months from the last login, so that you have the opportunity to find your data if you decide to return to the app within that time; instead the data will be deleted immediately if you ask us to delete it.

 

  1. b) If you want to create your avatar from an image of yourself, we will process your photo if you consent to the access of your multimedia content on your device and/or if you authorize us to temporarily use the camera of your device; the legal basis for this data processing is your optional consent.

If you do not express your consent to this processing we will not be able to upload the photo but the app will still work; when you replace the photo image with another photo or with that of your avatar profile, the previously uploaded photo will be immediately deleted from our archives; multimedia content that you have not chosen as a profile photo will never be recorded by us; in the same way the camera will activate only with your express authorization.

 

  1. c) If you consent to push notifications, we will be able to send you notifications relating to Challenges, the legal basis for this data processing is your consent.

If you do not give your consent, the MOD4 app will still work but you will not be updated in real time (e.g. on the progress achieved or on the challenge requests from other users);

you can at any time revoke the consent given and/or object to processing for sending push notifications, by writing to privacy@avawear.it or in the app under Settings in the section Game Notifications.

 

SUBSCRIPTION TO THE NEWSLETTER

 

  • Purpose, data processed, legal basis for the processing of your personal data and storage period for the subscription to the newsletter service.

The purpose of Avawear S.r.l. is to send, via electronic mail (email), commercial and/or promotional communications of Avawear S.r.l. (“Newsletter”) to those who explicitly request it.

The legal basis for the processing of your personal data is the execution of the contract, which is to fulfill your request to subscribe to the newsletter service.

We will process your email address and providing this data is mandatory; therefore, any refusal to provide it makes it impossible to provide you with the newsletter service.

To compare and possibly improve communications, systems are used for sending newsletters and promotional communications equipped with a reporting mechanism, which provides us with information such as: the number of readers, openings and clicks; the type of device used to read the communication (desktop, mobile); the number of pending users who have not yet confirmed registration; the number of emails sent by date/hour/minute; the detail of the emails delivered compared to those sent; the list of unsubscribed from the newsletter; openings of emails and clicks on individual links; problems displaying the message; link tracking (e.g. the number of clicks made on the message links); click tracking (which links were clicked). All data is used for the purpose of comparing, and possibly improving, the results of communications.

This is an integral component of the Avawear S.r.l. newsletter.

You can however deactivate the display of images in your email program, though in this case we cannot guarantee that the complete display of the email.

 

Transfer of Data Abroad

The management and storage of personal data will be carried out by Avawear S.r.l. on servers of the Data Controller located within the European Union.

However, the newsletter service is provided through MailChimp which is a service of The Rocket Science Group, LLC based in 675 Ponce de Leon Ave NE, Suite 5000 Atlanta, GA 30308 USA which adheres and certifies its compliance with the EU-U.S. Privacy Shield Framework, therefore subject to review by the United States Federal Trade Commission. In specific cases, MailChimp may be required to disclose personal information in response to requests legitimately made by Public Authorities, determined by the need to ensure national security or by the obligation to observe United States laws.
MailChimp declares to adopt appropriate and adequate security measures, both technical and organizational, to protect personal data from loss, abuse, unauthorized access, illegal disclosure, alteration and destruction, having assessed the risks related to the processing activities and the nature of the personal data managed. Further information on safety practices is available at the following link https://mailchimp.com/about/security/

 

Storage Period

Your personal data will be kept until you ask to unsubscribe from the newsletter service. Once you have unsubscribed, your data will be destroyed or made anonymous compatibly with the technical cancellation and backup procedures.

To unsubscribe from the newsletter, simply click on the unsubscribe link at the bottom of the emails received or by writing to the address privacy@avawear.it

 

TO WHOM WE COMMUNICATE YOUR DATA

 

  • Recipients of Personal Data

For the mobile app service “MOD4”:

Your data is processed by a third-party company designated as a Data Processor, to whom adequate operating instructions have been given, since it oversees on behalf of Avawear S.r.l. the management service of the mobile app “MOD4”.

The data relating to the scores obtained in the “Challenges” will be communicated to LUISA VIA ROMA S.p.A. so that you will be able to use them to make discounted purchases on the Luisaviaroma.com website or app.

For the Newsletter:

Your data is processed by a third-party company designated as a Data Processor, to whom adequate operating instructions have been given, since it oversees, on behalf of Avawear S.r.l., the newsletter service.

Furthermore, in general, data could also be disclosed to:

  1. a) public and private individuals who can access the data pursuant to the provisions of the law, regulation or community legislation, within the limits set by these rules;
    b) individuals who need to access data for purposes related to the contractual relationship between the parties, within the limits strictly necessary for the performance of auxiliary tasks (e.g. suppliers of technical services, hosting provider, IT companies);
    c) consultants, within the limits necessary for the performance of their professional assignment.

You can request the updated list of External Data Processors, kept at the headquarters of the Data Controller, by writing to privacy@avawear.it.

 

YOUR RIGHTS

  • Rights of Data Subjects

You may exercise, at any time, the rights provided to you in Articles 15, 16, 17, 18, 20 and 21 of the GDPR which, in particular, confer the rights to:

  1. a) obtain from the Data Controller, pursuant to Article 15, confirmation of the existence or not of personal data being processed and, in this case, obtain access to the data and information such as: (i) the purposes of the processing; (ii) the categories of personal data; (iii) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients located in Third Countries or International Organizations; (iv) when possible, the retention period of the personal data provided or, if not possible, the criteria used to determine this period;
    b) obtain from the Data Controller, pursuant to Article 16, the correction of inaccurate personal data without undue delay; taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, by providing an additional declaration;
    c) obtain from the Data Controller, pursuant to Article 17, the deletion of their personal data without undue delay. The Data Controller has the obligation to cancel, without undue delay, personal data if there is one of the reasons indicated in paragraph 1 of Article 17;
    d) obtain from the Data Controller, pursuant to Article 18, restriction of processing when one of the hypotheses governed by paragraph 1 of Article 18 occurs;
    e) obtain from the Data Controller, pursuant to Article 20, the portability of data or to receive in a structured, commonly used and machine-readable format, their personal data provided to a Data Controller. The data subject also has the right to transmit such data to another Data Controller without impediments by the first Data Controller to whom it has provided them, if the conditions indicated in Article 20 paragraph 1 are met. Finally, the data subject has the right to obtain the direct transmission of personal data from one Data Controller to another, if technically feasible;
    f) object to, in whole or in part, pursuant to Article 21, the processing of their personal data.

To exercise these rights, you can send a request to privacy@avawear.it.

Avawear S.r.l. may request a fee if the requests are blatantly unfounded, excessive or repetitive; in this regard, Avawear S.r.l. will maintain records to track requests for intervention.

The data subject also has the right to lodge a complaint with a Control Authority.

Policy updated on 28 May 2020.