Difa Cooper Spa (the “Company“) provides below the privacy information pursuant to EU Regulation 2016/679 (the “Regulation“), in its capacity as data controller of the personal data of users (“Users“) who browse the websites of the Company or register on the Sites to take advantage of particular services or features, accessible at the following addresses:
www.cantabrialabsdifacooper.it
www.cosmeticimagistrali.it
(Without distinction, the “Site” or the “Sites“)
It should be noted that this information refers only to the Company’s sites and not to other websites, which may be accessible by the User via hypertext links present therein but referring to resources external to the domains of the afore mentioned entity.
Data Controller
The data controller is Difa Cooper Spa, with sole shareholder, with registered office in Via Milano n. 160, 21042 Caronno Pertusella (VA), share capital of Euro 750,000 fully paid up, R.E.A. (VA) 129020 – Fiscal Code VAT and Company Reg. (VA) – IT 00334560125, Company subject to the management and coordination of Industrial Farmaceutica Cantabria S.A.
The User’s Personal Data
As Data Controller, we protect your personal data. Personal data means all information relating to the User, an identified or identifiable natural person (the “interested party” pursuant to the Regulation), by way of example: personal data, contact data, data relating to the products of interest and any data spontaneously provided by the User in interactions with the Company, as well as information automatically acquired by the Site.
The Owner may also become aware of particular data (formerly sensitive) of the User such as information on the state of health and well-being, for example in the event that the User communicates any intolerances and/or undesirable effects encountered following the use of Company products. For the processing of the User’s “Special Data”, see the dedicated section of this Information.
Data Source
We collect personal data from the Site User to offer a quality service to Users and improve the offer of our products and services. Apart from what is specified for navigation data acquired automatically, the User is free to provide his personal data or not to provide them. Failure to provide such data may only make it impossible to be contacted and to obtain the requested service.
In particular, the data processed by the Data Controller are:
Data communicated by the User: any data provided voluntarily by the User through the Site or to the contact addresses of the Company, by way of example:
(a) through the messages inserted in the forms on the Site, in the letters/emails/faxes spontaneously sent to us at the postal, electronic mail, or fax numbers published on the Site;
(b) during telephone contact with the Company and with customer care;
(c) through private messages sent to institutional profiles/pages on social media;
(d) when registering for prize events and other promotional initiatives published or advertised through the Site;
(e) when subscribing to newsletters or other information activities;
(f) with reports of allergies, intolerances and/or adverse reactions;
(g) by sending CVs in the section of the Website or to the contact addresses of the Company.
Data collected automatically during use of the Site: navigation data and cookies. The computer systems and software procedures used to operate this site acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols. This is information that is not collected to be associated with identified interested parties, but which by their very nature could, through processing and association with data held by third parties, allow users to be identified. This category of data includes the IP addresses or domain names of the computers used by users who connect to the Site, the addresses in URI (Uniform Resource Identifier) notation of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to your operating system and your computer environment.
Cookies and other tracking systems
Visit the Cookie section on the Site.
Purpose of the treatment
The User’s personal data indicated in this statement are processed by the Data Controller for the following purposes:
- The contact details and all the data included in the User’s communications and/or interactions with the different Company channels to take advantage of services or features, are acquired and processed by the Owner to respond to requests sent by the User or to provide the selected service.
The processing of this data is carried out to provide the service requested by the User (Article 6, paragraph 1, letter b) of the Regulation).
- The data provided by the User when registering for the newsletter and/or consultancy service offered on the Site are processed by the Data Controller for marketing purposes exclusively on the basis of the User’s express consent to the sending of promotional and commercial communications relating to products and/or o Company events and/or training courses, as well as carrying out market studies and statistical analyses.
The processing of this data is carried out with the express, free and optional consent of the User (Article 6, paragraph 1, letter a) of the Regulation). This consent can be freely and freely revoked by the User at any time. In relation to promotional communications sent by e-mail, the User may withdraw consent to the processing of the e-mail address for marketing purposes also by clicking on the unsubscribe link present in each promotional e-mail.
- Navigation data is processed for the sole purpose of obtaining anonymous statistical information on the use of the Site and to check its correct functioning. The data could be used to ascertain responsibility in the event of hypothetical computer crimes against the Site.
The navigation data are processed for the legitimate interest of the Data Controller in guaranteeing the security of the Site, checking its correct functioning and obtaining statistics in relation to its use (Article 6, paragraph 1, letter f) of the Regulation).
- The processing of some personal data of the User is necessary to fulfill legal obligations. For example, to process reports in the context of pharmacovigilance (Article 6, paragraph 1, letter e) of the Regulation).
- The processing of some personal data of the User is necessary for the pursuit of the legitimate interest of the Owner, including: ascertaining, exercising or defending one’s rights in court or preventing fraud, further development of products, services and offers of assistance, management of risks (Article 6, paragraph 1, letter f) of the Regulation).
Specific information is published on the pages of the Site set up for the provision of certain services or features.
Profiling
Where expressly indicated and only with the free and optional consent of the User (article 6, paragraph 1, letter a) of the Regulation) we may process the User’s personal data for profiling purposes in order to send personalized communications, to carry out analyzes and processing statistics, for so-called “clustering” and internal analyzes and monitoring of market and consumption trends. In the event of failure to consent to the processing of personal data for profiling purposes, the ability to navigate on the Site will not be compromised in any way nor will the User suffer any another harmful consequence. Consent to profiling can in any case be revoked freely and free of charge at any time.
Particular Data
Particular categories of data pursuant to art. 9 of the Regulation, could be provided spontaneously by the User in the context of specific requests to the Company. In this case, the treatment is carried out on the basis of the User’s consent, as well as for the obligations connected to the reports of adverse events, to fulfill the obligations deriving from laws or regulations, or to fulfill contractual or pre-contractual obligations concerning the supply of goods or services (including requests for product information). In any case, the Data Controller will process information relating to the User’s state of health only for the time strictly necessary and/or to fulfill legal obligations.
Data retention period
The processing of your personal data will be carried out using automated and non-automated tools, with logic strictly related to the purposes themselves and, in any case, in order to guarantee the security and confidentiality of the data.
Except for specific information for individual services in this Policy, the following principles generally apply to data retention:
- We keep the User’s personal data only for the time necessary for the pursuit of the intended purposes or, in the case of consent, until the consent has been revoked.
- For legal obligations and for fiscal-administrative purposes inherent to the Company’s activity (e.g. in the event of the provision of a service or resolution of a complaint), we will keep the data for the period established by the fiscal legislation and by the applicable legislation on the subject of retention of company deeds and correspondence (10 years).
- If you object to the processing, we will delete your personal data, unless their further processing is necessary to pursue other legitimate purposes of the processing.
- We will also delete your personal data when we are obliged to do so due to any legal obligations.
Candidate data is kept for a maximum period of 24 months from receipt of the application.
Information on the storage duration of cookies can be found in our cookie policy.
Subjects who can access the data
The data collected following consultation of the Site can be accessed by the following subjects designated by the institution, pursuant to art. 28 of the Regulation as data controllers:
- Allys Srl as supplier of web platform development and maintenance services
- Alliance Software Srl for the management of the recruitment process with reference to the applications that pass through the Site.
The personal data collected is also processed by Company personnel who have been authorized and who act on the basis of specific instructions provided in relation to the purposes and methods of the processing itself.
The User’s data may also be communicated to other companies of the Cantabria Labs Group in the EU for the same purposes and/or for technical, administrative, or accounting purposes.
Rights of the interested parties
The interested parties, in the cases and under the conditions established (Article 15 and following of the Regulation), have the right to obtain from the Company:
- access to your personal data
- the rectification of inaccurate personal data and the integration of incomplete personal data
- the cancellation of personal data for which the legal basis for the treatment is missing
- the limitation of the use of personal data
- the cessation of the processing of personal data by exercising the opposition to the processing for reasons connected to the particular situation of the interested party, or to the processing for marketing and profiled marketing purposes.
- the termination of the processing of personal data through the withdrawal of consent in the event that the processing is based on consent
- the copy of your data (so-called portability)
- by written request to the Data Controller to be sent to the following contact details:
Difa Cooper SpA, registered office in Via Milano 160, Caronno Pertusella 21042 (VA), email: privacy@difacooper.com.
Right of Complaint
Interested parties who believe that the processing of personal data referring to them carried out through the Sites takes place in violation of the provisions of the Regulation have the right to lodge a complaint with the Guarantor, as provided for by art. 77 of the Regulation itself, or to take the appropriate judicial offices (art. 79 of the Regulation).
The Company reserves the right to update and/or modify this information at any time.
Last update date: 09/13/2022