Privacy Policy

1. INFORMATION ON THE COLLECTION OF PERSONAL DATA AND CONTACTS OF THE MANAGER

• 1.1We are delighted that you are visiting our website and thank you for your interest. In the following we inform you about the handling of your personal data when using our website. Personal data is all data with which you can be personally identified.
• 1.2The data controller on this website in accordance with the General Data Protection Regulation (GDPR) is Colleverde S.r.l, Vocabolo Coldipozzo 48, 06012 Città di Castello, PG, Italy. E-mail: info@villabizzishop.com . The person responsible for the processing of personal data is the natural or legal person who, alone or jointly with others, decides on the purposes and means of processing personal data.
• 1.3For security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or inquiries to the responsible person), this website uses an SSL or TLS encryption. An encrypted connection can be recognized by the character string "https://" and the padlock symbol in the browser line.

2. INFORMATION ON THE COLLECTION OF PERSONAL DATA AND CONTACTS OF THE MANAGER

3. CONTENT DISTRIBUTION NETWORK

• 3.1

  AWS-CloudFront (Amazon)

  On our website we use the Content Delivery Network ("CDN") "AWS CloudFront" of the service provider "Amazon" ("Amazon EU Sa rl, 38 avenue John F. Kennedy, L-1855 Luxembourg").

  A content delivery network is an online service used to deliver especially large multimedia files (such as graphics, page content, or scripts) through a network of regionally distributed servers connected via the Internet. Using Amazon's Content Delivery Network helps us to optimize the loading speed of our website.

  The processing is carried out in accordance with Article 6 paragraph 1 letter f GDPR on the basis of our legitimate interest in providing our website securely and efficiently and in improving the stability and functionality of our website. For more information, see Amazon's privacy policy at https://docs.aws.amazon.com/gb_en/AmazonCloudFront/latest/DeveloperGuide/data-protection-summary.html

• 3.2

  Fast

  On our website we use a so-called Content Delivery Network ("CDN") of the technology service provider Fastly Inc., 475 Brannan St. #300, San Francisco, CA 94107, USA ("Fastly"). A content delivery network is an online service used to deliver especially large multimedia files (such as graphics, page content, or scripts) through a network of regionally distributed servers connected via the Internet. Using Fastly's Content Delivery Network helps us to optimize the loading speed of our website.

  The processing is carried out in accordance with Article 6 paragraph 1 letter f GDPR on the basis of our legitimate interest in providing our website securely and efficiently and in improving the stability and functionality of our website. For more information, see Fastly's privacy policy at: https://www.fastly.com/privacy

4. COOKIES

5. CONTACT

6. DATA PROCESSING WHEN OPENING A CUSTOMER ACCOUNT AND FOR PROCESSING THE CONTRACT

7. USE OF CUSTOMER DATA FOR DIRECT MARKETING

• 7.1

  Signing up for our email newsletter

  If you register for our e-mail newsletter, we will send you regular information about our offers, restocks and new products. You can find all detailed entries on the page your account, you can adjust your newsletter or deactivate it. The only mandatory data for sending the newsletter is your e-mail address. The provision of further data is optional and is used to be able to address you personally.

  By entering your email address, you expressly give us your consent to the use of your personal data in accordance with Article 6 (1) (a) GDPR. When you register for the newsletter, we save your IP address entered by the Internet Service Provider (ISP), as well as the date and time of registration in order to be able to trace any misuse of your e-mail address at a later time/time. The data collected by us when registering for the newsletter is used exclusively for advertising or information purposes via the newsletter. You can unsubscribe from the newsletter at any time via the link provided for this purpose in the newsletter, by sending a message to the responsible person mentioned above or by deactivating in the dedicated section of your account page. After you unsubscribe, your e-mail address will be immediately deleted from our newsletter distribution list.

  You can unsubscribe from the newsletter at any time via the link provided for this purpose in the newsletter, by sending a message to the responsible person mentioned above or by deactivating in the dedicated section of your account page. After you unsubscribe, your e-mail address will be immediately deleted from our newsletter distribution list.

• 7.2

  Use of services for sending the newsletter

  Our e-mail newsletter is sent via a third-party service to which we pass on the data you provide when registering for the newsletter. This transfer takes place in accordance with Article 6 (1) (f) GDPR and fulfills our legitimate interest in using an effective, secure and user-friendly newsletter system. The data entered for subscription to the newsletter (e.g. e-mail address) will be archived on the servers of the third-party service.

  The third service. uses this information to send and statistically evaluate the newsletter on our behalf. For evaluation purposes, the e-mails sent contain so-called web beacons or tracking pixels, which are one-pixel image files that are stored on our website. In this way it can be determined whether a newsletter message has been opened and which links have been clicked. With the help of so-called conversion tracking, it is also possible to analyze whether a previously defined action (e.g. the purchase of a product on our website) has taken place after clicking on the link in the newsletter. Technical information is also logged (e.g. time of retrieval, IP address, browser type and s operating system). The data is collected exclusively in pseudonymized form and is not linked to your other personal data, a direct personal reference is excluded. This data is used exclusively for the statistical analysis of the newsletter campaigns. The results of these analyzes can be used to better tailor future newsletters to the interests of the recipients.

  If you wish to object to data analysis for statistical evaluation purposes, you must unsubscribe from the newsletter.

  We have entered into an order processing agreement with the third-party service, in which we oblige the third-party service to protect our customers' data and not to pass it on to third parties.

  Further information on the data protection of the third-party service can be found in the data protection declaration of the third-party service: https://boo.com

8. DATA PROCESSING FOR ORDER FULFILLMENT

• 8.1To process your order, we cooperate with the following service providers, who fully or partially support us in the implementation of the concluded contracts. Some personal data is transmitted to these service providers in accordance with the following information.

  The personal data collected by us will be passed on to the transport company commissioned with the delivery under the contract, insofar as this is necessary for the delivery of the goods. We pass on your payment data to the commissioned credit institution as part of the payment process, provided this is necessary for the payment process. If payment service providers are used, we will explicitly inform you below. The legal basis for the data transfer is Article 6(1)(b) of the GDPR.

• 8.2Disclosure of Personal Data to Shipping Service Providers

  Personal data will be disclosed to the shipping service provider, we will provide your email address in accordance with Article 6 (1) (a) GDPR before the goods are delivered for the purpose of coordinating a delivery date or notification of delivery provided that you have given your explicit consent during the ordering process. Otherwise, we will only pass on the recipient's name and delivery address to the carrier for the purpose of delivery in accordance with Article 6 (1) (b) GDPR. The data will only be passed on if it is necessary for the delivery of the goods.

• 8.3Use of payment service providers (payment services)

  Apple Pay

  If you choose the "Apple Pay" payment method from Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, your payment will be processed using the "Apple Pay" function of your iOS, watchOS or macOS device by charging a payment card stored with "Apple Pay". Apple Pay uses security features built into your device's hardware and software to protect your transactions. In order to unblock a payment, it is therefore necessary to enter a code previously defined by you and verify it using the "Face ID" or "Touch ID" function of your device.

  For payment processing purposes, the information you provide during the ordering process, together with your order information, will be sent to Apple in encrypted form. Apple then re-encrypts this data with a specific developer key before the data is sent to the payment service provider of the payment card stored in Apple Pay to process the payment. Encryption ensures that only the website through which the purchase was made can access your payment details.

  After you make the payment, Apple will send your device account number and a transaction-specific dynamic security code to the originating website to confirm the success of the payment.

  If personal data is processed in the described transmissions, the processing is carried out exclusively for the purpose of payment processing in accordance with Article 6 (1) (b) GDPR.

  Apple retains anonymous information about the transaction, including the approximate purchase amount, the date and time, and whether the transaction was completed successfully. Anonymisation completely excludes any personal references. Apple uses the de-identified data to improve Apple Pay and other Apple products and services.

  When you use Apple Pay on your iPhone or Apple Watch to complete a purchase made through Safari on your Mac, your Mac and the authorizing device communicate through an encrypted channel on Apple's servers. Apple does not process or store any of this information in a format that personally identifies you. You can disable the ability to use Apple Pay on your Mac in your iPhone settings. Go to Wallet & Apple Pay and turn off Dont allow payments on Mac.

  Further information on data protection with Apple Pay can be found at the following Internet address:

  https://support.apple.com/en-euro/HT203027

  Google Pay

  If you decide to use the "Google Pay" payment method of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"), your payment will be processed using the "Google Pay" application on your device with a mobile device with at least Android 4.4 ("KitKat") equipped with NFC function, by debiting a payment card stored with Google Pay or a payment system verified there (e.g. PayPal). To unblock a Google Pay payment of more than €25, you must first unblock your mobile device using the verification measure you set up (for example, facial recognition, password, fingerprint or pattern).

  For the purposes of payment processing, the information you provide during the ordering process together with your order information will be transmitted to Google. Google then transmits the payment information stored in Google Pay in the form of a unique transaction number to the originating website, which is used to verify that the payment has been made. This transaction number does not contain any information about the real payment data of your payment methods stored with Google Pay, but is created and transmitted as a uniquely valid numerical token. For all transactions via Google Pay, Google only acts as an intermediary to process the payment process.

  For the purposes of payment processing, the information you provide during the ordering process together with your order information will be transmitted to Google. Google then transmits the payment information stored in Google Pay in the form of a unique transaction number to the originating website, which is used to verify that the payment has been made. This transaction number does not contain any information about the real payment data of your payment methods stored with Google Pay, but is created and transmitted as a uniquely valid numerical token. For all transactions via Google Pay, Google only acts as an intermediary to process the payment process.

  If personal data is processed in the described transmissions, the processing is carried out exclusively for the purpose of payment processing in accordance with Article 6 (1) (b) GDPR.

  Google reserves the right to collect, store and evaluate certain process-specific information for each transaction made via Google Pay. This includes the date, time and amount of the transaction, the location and description of the merchant, a description provided by the merchant of the goods or services purchased, photographs included in the transaction, the name and email addresses of the seller and buyer, or sender and recipient, the payment method used, the description of the reason for the transaction and, if applicable, the offer associated with the transaction.

  According to Google, this processing takes place exclusively in accordance with Article 6 paragraph 1 letter f GDPR on the basis of the legitimate interest in proper accounting, verification of transaction data and optimization and functional maintenance of the Google Pay service.

  Google also reserves the right to combine processed transaction data with other information collected and stored by Google when using other Google services.

  The Google Pay Terms of Use can be found here:

  https://payments.google.com/payments/apis-secure/u/0/get_legal_document?ldo=0&ldt=googlepaytos&ldl=en

  Further information on data protection with Google Pay can be found at the following Internet address:

  https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=en

  PayPal

  When paying by PayPal, credit card via PayPal, direct debit via PayPal or - if offered - "purchase on account" or "payment in installments" via PayPal, we pass on your payment data to PayPal (Europe) Sarl et Cie, SCA, 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter "PayPal"), continued. The transfer takes place in accordance with Article 6 paragraph 1 letter b of the GDPR and only insofar as this is necessary for payment processing.

  PayPal reserves the right to carry out a credit check for the payment methods credit card via PayPal, direct debit via PayPal or - if offered - "purchase on account" or "payment in installments" via PayPal. For this purpose, your payment data may be passed on to credit agencies in accordance with Article 6 (1) (f) GDPR on the basis of PayPal's legitimate interest in determining your creditworthiness. PayPal uses the result of the credit check in relation to the statistical probability of non-payment for the purpose of deciding whether to provide the respective payment method. The credit report can contain probability values (so-called score values). As far as the score values are included in the credit report result, they are based on a scientifically recognized mathematical-statistical process. Among other things, but not limited to, address data is included in the calculation of score values. Further information on data protection, including information on the credit agencies used, can be found in PayPal's data protection declaration: https://www.paypal.com/en/webapps/mpp/ua/privacy-full

  You can object to this processing of your data at any time by sending a message to PayPal. However, PayPal may still be entitled to process your personal data if this is necessary for contractual payment processing.

  Stripes

  If you choose a payment method from the payment service provider Stripe, your payment will be processed through the payment service provider Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, to whom we will send the information provided during the ordering process together with information about your order (name, address, account number, sort code, possibly credit card number, invoice amount, currency and transaction number) in accordance with Article 6 paragraph 1 letter b GDPR. You can find more information about Stripe's data protection at the URL https://stripe.com/privacy#translation

  Stripe reserves the right to carry out a credit check based on mathematical-statistical procedures in order to protect the legitimate interest in determining the user's creditworthiness. Stripe may pass personal data required for a credit check and received as part of payment processing to selected credit agencies, which Stripe discloses to users upon request. The credit report can contain probability values (so-called score values). As for the score values included in the result of the credit report, they are based on a scientifically recognized mathematical-statistical process. Among other things, but not limited to, address data is included in the calculation of score values.

  You can object to this processing of your data at any time by sending a message to Stripe or the responsible credit agencies. However, Stripe may still be entitled to process your personal data if this is necessary for contractual payment processing.

9. RIGHTS OF THE INTERESTED PARTY

9.1The applicable data protection legislation guarantees the data subject extensive rights (rights of information and intervention) vis-à-vis the controller of the user's personal data, about whom we inform you below:

• Right to information pursuant to Article 15 GDPR: in particular, you have the right to information about your personal data processed by us, the purposes of the processing, the categories of personal data processed, the recipients or categories of recipients to whom your data has been or will be disclosed the envisaged retention period or the criteria for determining the retention period, the existence of a right of rectification, cancellation, limitation of processing, opposition to processing, complaint to a supervisory authority, l 'origin of your data if it was not collected from you by us, the existence of automated decision-making including profiling and meaningful information about the logic involved and the scope and intended effects of such processing on you, as well as your right to information on guarantees pursuant to article 46 GDPR when your data is transmitted to third countries;
• Right to rectification in accordance with Article 16 GDPR: You have the right to immediate rectification of incorrect data concerning you and/or completion of your incomplete data stored by us;
• Right to erasure pursuant to article 17 GDPR: you have the right to request the erasure of your personal data if the requirements of article 17 paragraph 1 GDPR are met. However, this right does not apply in particular if the processing is necessary to exercise the right to freedom of expression and information, to fulfill a legal obligation, for reasons of public interest or to assert, exercise or defend legal claims;
• Right to limitation of treatment pursuant to article 18 GDPR: you have the right to request limitation of the processing of your personal data provided that the correctness of your data is verified, that you contest, if you refuse to delete your data due to a inadmissible data processing and instead request the restriction of the processing of your data if you need your data to assert, exercise or defend legal claims after we no longer need this data after the purpose has been achieved or if you have filed a opposition for reasons related to your particular situation, provided it is not yet clear whether our legitimate reasons prevail;
• Right to information pursuant to Article 19 GDPR: if you have asserted your right to rectification, deletion or restriction of processing against the controller, the controller is required to inform all recipients to whom the personal data have been disclosed that concern you rectification or cancellation and data or limitation of processing, unless this proves impossible or involves a disproportionate effort. You have the right to be informed about these recipients.
• Right to data portability according to Article 20 GDPR: you have the right to receive your personal data that you have provided to us in a structured, common and machine-readable format or to request transmission to another responsible person, insofar as this is technically feasible;
• Right to revoke the consent granted pursuant to Article 7 paragraph 3 GDPR: You have the right to revoke your consent to data processing at any time with effect for the future. In the event of a revocation, we will immediately delete the data concerned, unless further processing can be based on a legal basis for processing without consent. The withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent up until the moment of the withdrawal;
• Right to lodge a complaint pursuant to Art. 77 GDPR: If you believe that the processing of your personal data violates the GDPR, you have - without prejudice to any other administrative or judicial remedy - the right to lodge a complaint with a supervisory authority, in particular in the Member State where you live, work or where the alleged infringement has occurred.

• 9.2RIGHT TO OBJECT

  IF WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF A BALANCE OF INTERESTS IN OUR PREVIOUS LEGITIMATE INTERESTS, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO SUCH PROCESSING ON GROUNDS ARISING FROM YOUR PARTICULAR SITUATION WITH EFFECT FOR THE FUTURE.

  IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA INVOLVED. HOWEVER, FURTHER PROCESSING REMAINS CONFIDENTIAL IF WE CAN DEMONSTRATE COMPLETE REASONS FOR THE PROCESSING WHICH OVERWEAR YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FUNDAMENTAL FREEDOMS, OR IF THE PROCESSING IS FOR THE CERTIFICATION, EXERCISE OR DEFENSE OF LEGAL ACTIONS.

  IF YOUR PERSONAL DATA IS PROCESSED BY US FOR DIRECT ADVERTISING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA FOR THE PURPOSE OF SUCH ADVERTISING. YOU MAY OBJECT AS DESCRIBED ABOVE.

  IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA INVOLVED FOR DIRECT MARKETING PURPOSES.

10. DURATION OF THE CONSERVATION OF PERSONAL DATA

• The duration of the storage of personal data is based on the respective legal basis, the purpose of the processing and, if applicable, also the respective statutory retention periods (e.g. commercial and tax retention periods).
• In the case of processing of personal data on the basis of explicit consent in accordance with Article 6 paragraph 1 letter a of the GDPR, this data is stored until the data subject withdraws his consent.
• If statutory retention periods exist for data processed within the framework of legal or similar obligations on the basis of Article 6(1)(b) of the GDPR, this data will be routinely deleted after expiry of the retention period, at provided it is not necessary they are no longer necessary to fulfill or initiate a contract and/or we have no legitimate interest in further storage.
• When personal data is processed on the basis of Article 6 (1) (f) GDPR, this data is retained until the data subject exercises his or her right to object under Article 21 (1) GDPR, unless that we cannot provide compelling reasons worthy of protection for the processing which outweigh the interests, rights and freedoms of the data subject, or the processing serves to assert, exercise or defend legal claims.
• In the case of the processing of personal data for the purpose of direct advertising on the basis of Article 6 paragraph 1 letter f of the GDPR, this data is stored until the data subject exercises his right of objection pursuant to Article 21 paragraph 2 of the GDPR.
• Unless otherwise specified in the other information contained in this statement on specific processing situations, stored personal data will be deleted when they are no longer necessary in relation to the purposes for which they were collected or otherwise processed.