Customer Information Notice on the Processing of Personal Data – XO Club Fidelity Program

With this document we provide you with information on how we process your personal data in accordance with Regulation (EU) 2016/679 and Legislative Decree no. 196/2003 regarding the XO Club Fidelity Program.

Data Controller

The Data Controller is Lidia Shopping s.r.l., with registered office at Via Fossato 8 - 46040 Rodigo (MN)

Contact details:

E-mail: customercare@lidiashopping.it

Via Fossato 8 – 46040 Rodigo (MN)

Purposes of Data Processing

We will collect and process your data in order to:

1. Perform the conditions relating to the issuance and management of the fidelity card and, in particular, to allow you to benefit from the advantages associated with the fidelity card;
2. With your consent, carry out promotional activities, within the limits of the consent provided;
3. With your consent, analyze your purchasing choices in order to tailor commercial offers as closely as possible to your profile and needs.

Categories of Data Processed

Personal Identification Data

In order to achieve the purposes indicated above, we will process your personal identification data (such as first and last name, email address, phone number, home or residence address, date of birth).

Legal Basis

• The processing of data for the purpose indicated in point 1 is necessary to perform the contract related to the issuance and management of the fidelity card.
• The processing of data for the purposes indicated in points 2 and 3 is possible upon the customer’s consent.

Please note that you may withdraw your consent at any time by sending a written communication to the addresses indicated above. This does not affect the lawfulness of processing based on consent given before withdrawal.

We kindly ask you to promptly notify us of any changes to your data so that our records can always be kept up to date.

Mandatory or Optional Nature of Data Provision and Consequences of Refusal

Providing the above data is necessary to establish, perform, and properly manage the contractual relationship. Therefore, failure to provide such data will make it impossible to obtain the fidelity card and benefit from its advantages.

Failure to provide data required for promotional and profiling activities will only result in the inability to send you informational and/or promotional material and to carry out profiling activities, without affecting the performance of the contract.

Categories of Recipients of Personal Data

Within the limits of the obligations, tasks, or purposes indicated above:

• personal data will be processed by our employees and/or collaborators;
• personal data may be communicated to agencies and/or collaborators carrying out marketing activities on our behalf;
• data will not be disclosed in any way;
• we may communicate and disclose personal data to comply with legal obligations.

Outside of these cases, your personal data may be communicated in Italy and/or abroad to:

• companies providing logistics, warehousing, packaging, shipping, delivery or collection services;
• public and/or private entities, natural and/or legal persons (legal, administrative and tax consultants), where such communication is necessary or functional for the proper fulfillment of contractual obligations or legal requirements, or for the establishment, exercise or defense of legal claims;
• entities authorized to access the data by virtue of legal provisions.

Data Retention Period

The data provided will be stored in our archives for the following periods:

• for the purposes referred to in point 1: for the duration of the contractual relationship and for 10 years following its termination for any reason, except where a longer retention period is required for potential disputes or requests from competent authorities;
• for the purposes referred to in points 2 and 3: 24 months from our last contact, understood as the termination of the contractual relationship or the sending of commercial communications, without prejudice to your right to request at any time not to receive further communications.

Data Subject Rights

You may exercise the following rights at any time and free of charge by contacting us at the addresses above:

• obtain confirmation as to whether or not personal data concerning you exists and be informed about its content and source, verify its accuracy and request its integration, update or correction;
• obtain the deletion, anonymization or blocking of data processed in violation of applicable law;
• object, in whole or in part, on legitimate grounds, to the processing;
• withdraw consent at any time (for processing based on consent), without affecting the lawfulness of processing carried out prior to withdrawal;
• request restriction of processing where:

• • you contest the accuracy of your data, for the period necessary to verify it;
  • the processing is unlawful and you oppose erasure and request restriction instead;
  • we no longer need the data, but it is required for the establishment, exercise or defense of legal claims;
  • you have objected to processing pursuant to Article 21(1) of the Regulation pending verification of overriding legitimate grounds.

• • receive a copy of your data in electronic format and transmit it to another service provider, where processing is based on consent or contract and carried out by automated means;
  • lodge a complaint with the Data Protection Authority.

Right to Object

You have the right to object at any time to the processing of personal data concerning you:

• to processing for direct marketing purposes, including advertising, direct sales, market research or commercial communication.
  You may also object to only one method of marketing (whether carried out by automated or non-automated means).