Privacy policy in accordance with Articles 13 and 14 of the GDPR

Thank you for visiting our website! The protection of your data is our top priority. In this privacy policy, we provide detailed information about how we process your data.
This policy applies both to data processing within Franciacorta Designer Village and to the use of our website. The legal basis for this data processing is the General Data Protection Regulation (GDPR) and the Italian Data Protection Act.
1    Data processing in general
1.1    Joint controllers 
Joint controllers pursuant to Art. 4(7) of the EU General Data Protection Regulation (GDPR) are 
ROS Italia S.r.l
Via Melchiore Giona 26 
20124 Milan
Palmanova Propco S.R.L
Via Melchiorre Gioia 26
20124 Milan
Tel: +39 0432837810
Email: info@palmanovadesignervillage.com

We, ROS Italia S.r.l, operate the website www.palmanovadesignervillage.com together with Palmanova Propco S.R.L. In this case, we are joint controllers for the processing of personal data. If we are obliged to fulfil data subject rights (see section 11), you can contact both us and Palmanova Propco S.R.L.
1.2    Data processing in accordance with Art. 13 GDPR
We process data that is provided to us by various individuals through their own disclosures, such as when registering for the VIP club, participating in competitions, applying for jobs, and concluding contracts.
1.3    Data processing in accordance with Art. 14 GDPR
In addition, we also process data that is not provided directly by the data subject. This is the case, for example, when management bodies provide us with the names and contact details of their employees in the context of projects or business relationships. If necessary for the provision of our services, we also process personal data from legally accessible public sources such as debtor registers, land registers, commercial and association registers, media reports or the internet. 
1.4    Data subjects
The following data is processed from interested parties: company, name of the contact person and professional contact details and address data.
We process the following data from contractual partners (e.g. VIP club members, competition participants, voucher purchasers): first and last name, email address, date of birth. 
We process the following data from tenants' contact persons: company, title and name of the contact person, business address and contact details, bank details, contract details.
We process the following data from suppliers and business partners that is necessary for the initiation or conclusion of a contract: company, title and names of contact persons, business address and contact details, bank details, contract data.  
We process the following data from event participants: name, contact and address details.
We process the following data from newsletter recipients: email address and name data.
We publish the names of authors upon request. As soon as the use of the works is discontinued, the personal data is automatically deleted.
1.5    Legal basis
The legal basis for data processing is:
–    Consent (e.g. when processing your email address for advertising purposes) in accordance with Art. 6(1)(a) GDPR 
–    Contract initiation and fulfilment pursuant to Art. 6(1)(b) GDPR
–    Legal obligations (e.g. statutory retention and documentation obligations, publication obligations under copyright law) pursuant to Art. 6(1)(c) GDPR
–    Legitimate interests of our company (e.g. use of software) in accordance with Art. 6(1)(f) GDPR 
We will inform you separately about the legal basis and purpose of the processing for each of the data processing operations described below.
1.6    Transfer of data
Data is transferred exclusively for the purpose of fulfilling the contract in accordance with Art. 6 (1) (b) GDPR in order to provide you with our services.
–    Transfer within the group of companies: Where necessary, the personal data collected will be transferred within the group of companies to parent companies and subsidiaries. This is necessary because various companies in the group provide IT services, among other things. The transfer is based on internally concluded contracts.
–    Transfer to processors: We work with processors to whom personal data is transferred in order to provide services efficiently. These include companies that perform tasks such as contract fulfilment, payment processing, account management, newsletter dispatch and IT services.
–    Other transfers: In certain cases, such as legal obligations or in the context of a legal dispute, personal data may be disclosed to authorities or solicitors.
1.7    Storage/deletion/anonymisation of data
–    Contractual retention obligations: After termination of a contractual relationship or after the end of contractually agreed periods, personal data will be deleted or anonymized as soon as there are no legal retention obligations to the contrary.
–    Revocation of consent: If consent to the processing of personal data is revoked, the data will be deleted or anonymized unless there is another legal basis for processing.
–    Statutory retention obligations: The controller is subject to a wide range of statutory retention obligations. Once these statutory retention obligations have expired, personal data will be automatically deleted. However, personal data may have to be retained for legal reasons despite the withdrawal of consent or the expiry of contractually agreed periods and may only be deleted at a later date (after the expiry of the respective legal periods). The EU regulations and laws to be complied with by the controller are listed below (without claiming to be exhaustive):
•    Tax Procedure Code and Taxpayer Statute (DPR 600/1973 and Statuto dei diritti del contribuente (L. 212/2000)
•    Civil Code, Book V (Company Law) and Corporate Insolvency Code (Codice Civile, Libro V (Delle Società) and Codice della crisi d’impresa e dell’insolvenza (D.Lgs. 14/2019)
•    Business Licensing Regulation (D.Lgs. 59/2010)
•    Civil Code (Codice Civile)
•    Value Added Tax Act (DPR 633/1972)
•    Personal Data Protection Code (Legislative Decree 196/2003 (Privacy Code), amended by Legislative Decree 101/2018)
•    General Data Protection Regulation (Regulation (EU) 2016/679 (GDPR))
2    Contact
When you contact us by email, telephone or social media, the data you provide will be stored in order to process your enquiries. 
Legal basis: Art. 6(1)(f) GDPR (legitimate interest)
3    Data processing of VIP Club members
If you decide to become a member of our VIP Club, we will process the data you enter in the form (online or print). Membership in our VIP Club, which offers many financial benefits, requires the outlet to be authorised to send you offers, information, advertising, invitations to competitions and promotions from the outlet's partners by e-mail.  
In order to complete your registration for the VIP Club, we require your title, first and last name, and a valid email address, as well as further confirmation that you are indeed the intended recipient of the communications sent to you. To do this, we will send a confirmation email with a link to the email address you provided (double opt-in). Your registration will only be complete once you have clicked on this link. 
If you would like to receive additional birthday vouchers as a member of the VIP Club, we also need your date of birth. However, you can also become a member without providing your date of birth. 
We collect further data in this context, provided you make it available, but this is not necessary for receiving promotional mailings. For example, we use your postcode to evaluate statistically and without personal reference which regions we reach with the newsletter and the Designer Outlet Soltau. 
If you no longer wish to receive mailings, you can terminate your membership at any time by sending an informal email to the contact details given in section one. 
Legal basis: Art. 6(1)(a) GDPR (consent)
4    Data processing for competition participation
If you participate in our competitions, we process your data for the purpose of conducting the competition, determining and notifying the winner, and sending the advertised prize. For this purpose, we require your name and email address. Without this data, you cannot participate in the competition. In this context, we also require your date of birth, as participants must be at least 18 years old. 
If you also provide your telephone number, we will use it to contact you by telephone if you have not responded to the previous prize notification by email. However, this is not necessary for the competition to be carried out. 
The data will be deleted after the winner has been determined and the competition has ended.  
Legal basis: Art. 6(1)(b) (contract initiation and fulfilment)
5    Application management
General: When you send us your application documents, we process the personal data contained therein for the purpose of personnel selection and recruitment.
Legal basis: Art. 6(1)(b) GDPR (contract initiation and fulfilment)
Deletion: In the event of rejection, we will delete your documents 6 months after sending you the rejection letter.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest)
Record keeping: If we wish to keep you on file for future contact, we will send you a separate request for your consent. If you explicitly give us your consent, we will store your application documents. If no further job opportunities arise at our company within one year of receiving your consent, we will delete all your application documents.
Legal basis: Art. 6(1)(a) GDPR (consent)
Application platforms: We use various online application platforms to recruit employees for our company. Individuals who are interested in working for our company can apply directly using a form provided by the operator of the application platform. Applicants decide for themselves what data they provide when using such an online portal. Personal data entered and documents uploaded are forwarded to us by the operator of the application platform. Both the application platform and we process this data as controllers within the meaning of the GDPR. Please note the privacy policies of the respective operators of the application platforms.
Legal basis: Art. 6(1)(b) GDPR (contract initiation and fulfilment) 
6    Social media presence
We operate social media pages on Instagram and Facebook. When you visit our social media pages, personal data, including your IP address, is processed by Meta Platforms Technologies Ireland Limited (Meta) and cookies are used for data collection. Please refer to the privacy policy of the respective service for details on exactly what information is transmitted. There you will also find information on how to contact them and how to restrict the processing of this data. 
We would also like to point out that you use the respective services and their functions at your own responsibility. This applies in particular to the use of interactive functions (e.g. sharing, commenting or rating). 
Meta has provided us with corresponding agreements – in most cases, these are agreements on joint responsibility for data processing. The use of social media platforms is based on our legitimate business interest.
If we are obliged to fulfil data subject rights (see16 ), you can contact both us and Meta.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest)
7    Data processing when using our website
7.1    Informational use of the website
When using the website for informational purposes only, we only collect the personal data that your browser transmits to our server (server log files). When you visit our website, we collect the data that is technically necessary for us to display our website to you and to ensure stability and security:
•    IP address
•    Date and time of the request
•    Time zone difference to Coordinated Universal Time (UTC)
•    Content of the request (specific page)
•    Access status/HTTP status code
•    Website from which the request originates
•    Browser
•    Operating system and its interface
•    Language and version of the browser software

This data is not merged with personal data sources. We reserve the right to subsequently check this data if we become aware of specific indications of illegal use and, in the event of a cyber attack, to pass the data on to the law enforcement authorities. No further disclosure to third parties takes place.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest)
7.2    Cookies 
When you visit our website, cookies are stored on your device. Cookies are small text files that are assigned to the browser you are using and stored on your hard drive. They enable us or third-party providers to collect certain information. Cookies cannot execute programs or transfer viruses to your computer.
The information contained in the cookies is used, for example, to determine whether you are logged in, what data you have already entered, or to recognize you as a user when a connection is established between our web server and your browser.
We distinguish between technical cookies, which serve exclusively to ensure the operation of a website, and cookies requiring consent, which are set by us or third-party providers for the purposes of statistical analysis, tracking or advertising/marketing.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest; for technical cookies), Art. 6(1)(a) GDPR (consent; for all other cookies)
Cookie details
7.3    Data transfer to a third country
It cannot be ruled out that personal data may be transferred to an insecure third country (countries outside the EEA without an adequate level of data protection) when you visit our website. If this is the case, we will point this out directly in the description of the external service in this privacy policy. 
The GDPR requires so-called suitable guarantees in accordance with Art. 46 GDPR for a data transfer to an insecure third country or to an international organization. 
In the case of data processing of personal data in a third country or in the case of data processing by US data recipients who have not submitted to the regulations of the EU-US Data Privacy Framework, the following risks in particular cannot currently be ruled out for you as a data subject: 
•    Your personal data could possibly be passed on to other third parties by the respective service provider beyond the actual purpose of order fulfilment. 
•    You may not be able to assert or enforce your rights to information against the respective service provider in the long term. 
•    There may be a higher probability that incorrect data processing may occur because the technical organizational measures for the protection of personal data do not fully meet the requirements of the GDPR in terms of quantity and quality.

By giving your consent via the consent banner to the use of external services and to the setting of the corresponding cookies, you expressly consent to the possible transfer of your personal data to insecure third countries.
Legal basis: Art. 6(1)(a) GDPR (consent)

8    Data processing when using Google services
We use the services of Google Ireland Limited ("Google"), a company incorporated and operated under Irish law with its registered office at Gordon House, Barrow Street, Dublin 4, Ireland, on our website. 
Further information can be found in Google's privacy policy at policies.google.com/privacy.
8.1    Google Fonts 
We use Google Fonts on our website. To ensure a uniform and appealing display of fonts and icons, your browser loads the required fonts into your browser cache. To do this, it is necessary for the browser you are using to contact the Google Fonts servers, which means that Google Fonts becomes aware that our website has been accessed via your IP address.
Legal basis: Art. 6(1)(a) GDPR (consent)
8.2    Google reCAPTCHA
We use the Google service reCAPTCHA to determine whether a human or a computer is making a specific entry in our contact or newsletter form. Google uses the following data to check whether you are a human or a computer IP address of the end device used, the website you visit with us and on which the captcha is integrated, the date and duration of the visit, the identification data of the browser and operating system type used, Google account if you are logged in to Google, mouse movements on the reCAPTCHA areas and tasks where you have to identify images. 
You can find more detailed information here: cloud.google.com/security/products/recaptcha
Legal basis: Art. 6(1)(a) GDPR (consent)
9    Data processing when using Usercentrics (Cookiebot)
In order to obtain data protection-compliant consent for the use of cookies and services requiring consent on our website, we use the Consent Banner Cookiebot from Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany.
The consent banner records and stores the selection of cookies and services requiring consent of the respective user of our website. The use of the consent banner ensures that statistical, functional and marketing cookies and services requiring consent are only set or loaded if the website visitor gives his or her express consent.
The consent tool records, logs and stores the website visitor's settings for the duration of the session. Cookiebot collects, transmits and stores certain user information (including the IP address) so that the selected settings can be clearly assigned to the respective website visitor.
For more information, please refer to the privacy policy of Usercentrics and usercentrics.com/us/privacy-policy/. 
Legal basis: Art. 6(1)(f) GDPR (legitimate interest)
10    Data processing when using web fonts by Hoefler&Co.  
Our website uses external fonts from Hoefler & Co, 611 Broadway, Room 725, New York, NY 10012-2608, USA. 
This service provides the "Cloud.Typography" fonts that are displayed on users' devices. Each time you use the service, your browser connects directly to the provider’s servers in the United States, transmitting your IP address.
By using this service, a transfer of personal data to the USA takes place or cannot be excluded! 7.3- For more information, please refer to section 7.3 of this declaration. 
Further information can be found in Typography's privacy policy: 
www.typography.com/policies/privacy 
Legal basis: Art. 6(1)(a) GDPR (consent)
11    Your rights
You have the following rights with regards to your personal data:
•    Right to information, correction and deletion
•    Right to restriction of processing
•    Right to object to processing
•    Right to data portability

In addition to the above rights, you have the right to lodge a complaint with a data protection authority, which in Italy is the Italian Data Protection Authority: 
•    Address: Piazza Venezia 11, 00187 Rome
•    Telephone: +39 06.696771  
•    Email: protocollo@gpdp.it

If you believe that we have violated Italian or European data protection law in the processing of your data and thereby infringed your rights, please contact us so that we can clarify any questions you may have.
Please send your enquiries and requests by email to info@palmanovadesignervillage.com or contact us using the contact details provided.
12    Changes to this privacy policy
We reserve the right to make changes to our privacy policy from time to time. All changes to the privacy policy will be published by us on this page. Please refer to the current version of our privacy policy for this information.