PROCESSING OF PERSONAL DATA FOR THE PURPOSES OF THE MIGRATION OF OLD USERS, MANAGEMENT OF USERS, DIRECT MARKETING, POSTAL MARKETING AND PROFILING OF DATA ON PURCHASING ACTIVITIES AND PROFILING OF BROWSING DATA
Unilever Italia Mkt. Operations S.r.l., with registered office in Rome, at via Paolo di Dono 3/A (hereinafter, “Unilever”) and Equilibra S.r.l., with registered office in Turin, at via Plava 74, (hereinafter, “Equilibra”) (jointly, the “Parties”).
The Parties belong to the same Unilever corporate group operating in the consumer goods distribution industry. The Parties mutually guarantee that they know and apply, with regard to their respective activities, all current legislation on the protection of personal data relevant to their own activities.
With a view to optimising the group synergy in the context of e-commerce, participation in online competitions and business communication, the Parties seek to follow a strategy aimed at implementing a group marketing policy geared towards the pursuit of the interests of both the company and the brand, as well as the interests of end users. In particular, the Parties seek to enhance the variety and complementarity of the products offered on the market by each of them, simplifying the online purchasing experience for users and offering them the option of readily accessing information and communication regarding the products themselves.
These objectives shall be pursued by the Parties through: i) the creation of digital spaces for e-commerce and online competitions that are based on a single technological platform that allows users to access the reserved areas of the Parties' websites with one single set of credentials; ii) joint management of the direct marketing, postal marketing, browsing data profiling and purchase data profiling purposes.
To make purchases or enter competitions, the user can decide to register within the Websites. In addition to personal data, consent will be requested on the registration forms for the following purposes: direct marketing, postal marketing, data profiling on purchasing activities. The purposes will be pursued by the Parties under a joint ownership arrangement; in fact, the methods for sending business communications and the logic underlying the profiling will be determined jointly. By registering, the user will be assigned a single set of login credentials that is valid for the reserved areas of the websites www.dettofranoi.it, www.equilibra.it and other websites that the Parties may decide to create.
ARTICLE 1: PREAMBLE AND ANNEXES
[OMISSIS]
ARTICLE 2: PROCESSING OPERATIONS
The processing operations that are the subject of this Joint Ownership Agreement are aimed at the following purposes: the purposes of migration of old users, user management purposes, direct marketing purposes, postal marketing purposes, the purposes of data profiling on purchasing activities and the purpose of browsing data profiling.
[OMISSIS]
ARTICLE 3: PURPOSE
By signing this Joint Ownership Agreement (Article 26 of the Regulations), with regard to the processing activities under Article 2 above, the Parties determine the following:
a) [OMISSIS]
b) [OMISSIS]
c) [OMISSIS]
d) Information to provide to data subjects under Article 13 of the Regulations as well as the collection/management of consent (policy and requests for consent): the privacy policy to be provided to data subjects during registration, accompanied by the relevant requests for consent, the privacy policy and the cookie policy will be provided by Unilever to the company that handles the management of the web content, which will proceed to publish this. The aforementioned documents shall be prepared in line with Regulations and the relevant provisions of the Supervisory Authority.
e) Requests of data subjects: Unilever acts as a contact point for data subjects for the purpose of handling requests from them pursuant to Article 15 et seq. of the Regulations on the processing that is the subject of this Agreement. In these cases, Unilever is committed to establishing the identity of data subjects beforehand to verify the lawfulness of the request. In any case, the data subject may exercise his or her own rights in respect of each of the two Parties which have an obligation to fulfil.
f) [OMISSIS]
g) Adoption of appropriate security measures under Article 32 of the Regulation: in particular, the Parties undertake to guarantee a level of security appropriate to the risk, taking into account, in particular, the risks that may arise from the specific processing operations covered by the Agreement, such as, for example, destruction or loss, including accidental loss, of the data, as well as unauthorised access or processing that is not allowed or deviates from the purposes for which the data was collected. [OMISSIS]
h) Timely notification of any personal data breaches to the supervisory authorities and to the data subject in the cases in which such compliance is required, under Articles 33 and 34 of the Regulations: subject to mutual collaboration, each Party shall proceed autonomously.
i) [OMISSIS]
ARTICLE 4: CANCELLATION
[OMISSIS]
ARTICLE 5: COMMENCEMENT AND DURATION
[OMISSIS]
ARTICLE 6: AMENDMENTS TO THE AGREEMENT
[OMISSIS]
Rome, 19/10/2020
