Privacy policy

Information on the processing of personal data
pursuant to Articles 13 et seq.
of the General Data Protection Regulation No. 2016/679 (“GDPR”)

Website www.angelico.it

Introduction

Dear user, when you access and browse this website (hereinafter the “Site”), some of your personal data are collected, stored and managed (in technical terms, “processed”) through the device you are using, including through the analysis and storage of your IP address, browsing data, “cookies” and other online identifiers such as “pixels”.

In view of these processing activities, and in compliance with applicable legislation imposing obligations concerning the protection, confidentiality and security of your data, L.A.R. Italia S.r.l. Unipersonale sets out below the purposes and means of processing in its capacity as Data Controller.

Data Controller

The processing of personal data carried out following access to and interaction with the Site will be performed by L.A.R. Italia S.r.l. Unipersonale, VAT and tax identification number 02669650026, with registered office at Via Visconti di Modrone 28, Milan (MI), and operational headquarters at Via Cavour 67, Gaglianico (BI), in its capacity as Data Controller.

L.A.R. Italia S.r.l. Unipersonale can be contacted as follows:

by e-mail at privacy@angelico.it
by telephone on 015542811
by ordinary mail at the registered office address indicated above.

Categories of data processed

The categories of data processed are as follows:

information concerning the user's browsing of the Site, including so-called online identifiers and data relating to the devices used
data concerning the opening of e-mail communications sent by the Data Controller, collected using so-called “tracking pixels”, such as: whether the message was opened, the date and time of opening, the type of device used and the IP address
identification and contact details voluntarily entered by the user on the Site, including data necessary to purchase goods and services, even without registering (so-called guest checkout), such as: first name, surname, e-mail address and telephone number
personal data necessary to manage shipping methods and systems, such as: residential address, domicile or place of residence
personal data necessary to manage payment methods and systems, such as: details of the payment instrument used and information relating to accounts on the selected payment system (e.g. PayPal)
personal data obtained from third parties or third-party sources in connection with specific initiatives or purposes promoted by the Data Controller
personal data concerning user behaviour (preferences and purchasing habits) in connection with the profiling activities offered
additional specifically identified personal data, if new features or services are implemented.

Purposes, legal bases and data retention periods

The table below sets out the specific purposes for which personal data are processed, together with the relevant legal basis and maximum data retention period, where this can be stated precisely (otherwise, the retention criterion on which the relevant technological tool was configured is indicated).

Purpose	Legal basis	Retention period
Provision of the Site's browsing functions, pages and content, such as product catalogues	Article 6(1)(b), for purposes necessary in connection with pre-contractual activities	for the duration of the user's visit to the Site, up to a maximum of 24 months.
Responding to contact requests or requests for information submitted by the user, including through a digital assistant service	Article 6(1)(f), for the pursuit of the Data Controller's legitimate interest in maintaining relationships with Site users	for a maximum of 10 years from the interaction with the user.
User registration to book an appointment at one of the Data Controller's retail stores	Article 6(1)(b), for purposes necessary in connection with pre-contractual activities	for a maximum of 6 months from the interaction with the user.
User registration, access to and use of the e-commerce shop, including “guest checkout”, as well as purchasing, payment, product management and delivery, and handling returns and refunds	Article 6(1)(b), for purposes necessary in connection with the contract and pre-contractual activities, including to enable, facilitate or simplify purchases	for the period necessary to achieve the stated purposes, up to a maximum of 10 years after the user's account is deleted from the e-commerce shop.
Management of the user's shopping cart in relation to the so-called abandoned checkout function following interruption of the purchase process or malfunctions of the e-commerce shop	Article 6(1)(f), for the pursuit of the Data Controller's legitimate interest in encouraging the recovery of purchasing interactions interrupted for technical reasons	for the period necessary to achieve the stated purpose, up to a maximum of 7 days after interruption of the purchase process or malfunctions of the e-commerce shop.
Management of accounting and tax documentation relating to purchases made through the e-commerce shop	Article 6(1)(c), for compliance with a legal obligation to which the Data Controller is subject (in particular, accounting and tax obligations)	for a maximum of 10 years after the purchase.
Management of unsolicited contacts from Site users through the submission of CVs and/or other communications	Article 6(1)(b), for purposes necessary in connection with pre-contractual activities	for a maximum of 12 months after the end of the recruitment process, unless further retention is necessary or the user has given consent.
Analysis of usage statistics and improvement of Site features through tools that produce statistics exclusively in aggregated form, in compliance with the conditions for exemption from consent set out in the Italian Data Protection Authority's Cookie Guidelines of 10 June 2021	Article 6(1)(f), for the pursuit of the Data Controller's legitimate interest in improving its products and services, including through the use of data pseudonymisation tools for statistical purposes	for only as long as necessary to completely anonymise the data collected.
Analysis of usage statistics and improvement of Site features through technologies involving data processing activities under Directive 2002/58/EC	Article 6(1)(a), on the basis of the user's consent, including through data pseudonymisation tools for statistical purposes and overall analysis of Site features	until the expiry of the longest-retained online identifier relating to the user, unless erasure or anonymisation is requested.
Recontacting the user by e-mail following a purchase of goods or services offered by the Data Controller in order to propose the sale of further similar goods or services; these communications do not contain so-called “tracking pixels”, unless the user has given specific consent	Article 6(1)(f), for the pursuit of the Data Controller's legitimate interest in promoting sales of its goods and services in compliance with the limits of Article 130(4) of Legislative Decree No. 196/2003 (so-called “soft spam”)	for a maximum of 24 months after the user's most recent purchase, without prejudice to the user's right to object by any means.
Recontacting the user following events, occasions or meetings at which the Data Controller or third parties have collected personal contact details	Article 6(1)(a), on the basis of the user's consent or, alternatively, Article 6(1)(f), for the pursuit of the Data Controller's legitimate interest in keeping in contact with a user who has expressed an interest in the goods and services offered	until consent is withdrawn or, where legitimate interest is relied upon, for a maximum of 3 months from receipt of the data, without prejudice to the user's right to object by any means.
User subscription to the newsletter and subsequent management of related commercial communications concerning special offers, promotions and news, through automated and non-automated systems (so-called marketing purposes); communications may contain so-called “tracking pixels” that detect when they are opened to measure their effectiveness, and the user may withdraw consent solely to their use at any time while continuing to receive communications	Article 6(1)(a), on the basis of the user's consent, including pursuant to Article 122 of Legislative Decree No. 196/2003 for the use of tracking pixels	until the user withdraws consent, and thereafter no longer than is technically and procedurally necessary. Data collected through tracking pixels are retained until the relevant consent is withdrawn and in any event for a maximum of 12 months from collection.

Further information about how we process data

If the user wishes to receive further information about the balance between the legitimate interests pursued by the Data Controller and the fundamental rights and freedoms of the individual, they may contact the Data Controller using the contact details provided and are entitled to receive a reply as soon as possible and, in any event, within the statutory time limits.

In the event of disputes involving the user or third parties, or inspections by the competent authorities, the retention period may be extended until the expiry of the last applicable limitation period.

The data will not be disclosed to the public in any way, except with the user's express prior consent and within the limits established by law.

Consequences of failure to provide data

Providing the personal data identified as mandatory is necessary to achieve the relevant purposes: failure to provide such data will make the corresponding processing impossible.

Providing other personal data is optional: failure to provide such additional data may make it wholly or partially impossible to access certain Site functions or features. With regard to marketing and profiling purposes, as well as so-called online identifiers that are not merely technical, consent to the processing of personal data is optional: the user has no legal or contractual obligation to provide such data for these purposes and/or to consent to the processing of their personal data for these purposes.

Automated decision-making

No processing of personal data through automated decision-making processes is envisaged under the legislation in force, in particular Article 22(1) and (4) of the GDPR.

In any event, any automated processing will not produce legal effects concerning the user or similarly significantly affect them, unless specific informed consent has been obtained and, in all cases, subject to the limits laid down by law.

Categories of parties processing personal data

Within the limits of the obligations, tasks or purposes indicated above, personal data may be processed, made available and/or disclosed to:

employees and/or collaborators of the Data Controller;
third parties appointed as Data Processors (in particular suppliers of goods or services), including their employees and/or collaborators;
judicial, administrative and/or public security authorities, in accordance with applicable laws.

A complete list of Data Processors and other third parties may be requested from the Data Controller at any time using the contact details provided.

Transfer of personal data outside the European Economic Area

For technical reasons, the user's personal data will be transferred to countries outside the European Economic Area, to entities established in countries recognised as “adequate” by the European Commission, including participants in the EU–US Data Privacy Framework, or to entities that have entered into appropriate Standard Contractual Clauses in the version approved by the European Commission currently in force.

Rights of the user as a data subject

The user may exercise the rights provided for by European Regulation No. 2016/679 at any time. In particular, the user has the right:

to access their personal data;
to obtain the rectification or erasure of those data or the restriction of processing concerning them;
to object to processing, where permitted;
to object at any time to the processing of their data for direct marketing purposes, including communications sent following a purchase (so-called “soft spam”), also using the link included in each e-mail;
to obtain data portability, where provided for;
to withdraw consent, including selectively (for example, by withdrawing consent only to the use of tracking pixels while continuing to receive marketing communications): withdrawal does not affect the lawfulness of processing carried out on the basis of consent given before its withdrawal;
to lodge a complaint with a supervisory authority: in Italy, the Italian Data Protection Authority (www.gpdp.it).

The rights referred to above may be exercised by sending a request to the Data Controller using the contact details provided, in particular the e-mail address specified in the “Data Controller” section.