pursuant to Article 13 of EU Regulation 679/2016 (“GDPR”)
1. DATA CONTROLLERS, JOINT DATA CONTROLLERS AND DATA PROCESSORS
Venchi S.p.A., with its registered office at Via V. Monti 8, 20123 Milan (MI) and administrative headquarters at Via Venchi 1, 12040 Castelletto Stura (CN), VAT No. 05744670968 (hereinafter, the “Data Controller” or “Venchi”) processes your personal data, in accordance with the specific purposes pursued and set out in this notice, pursuant to European Regulation 2016/679 (hereinafter the GDPR).
The aforementioned company acts as an independent Data Controller in relation to the data processing referred to in paragraph 2 below. Furthermore, Venchi S.p.A. and Venchi US Inc., with its registered office at 16 W 36th St, New York, NY 10018 (hereinafter, jointly, the “Joint Controllers”) act as independent data controllers in relation to the data processing referred to in paragraph 2 below.
They also act as Joint Controllers in relation to the data processing described in paragraph 3, having jointly determined the purposes and means of the processing through the conclusion of a specific agreement pursuant to Article 26 of the GDPR.
2. PROCESSING CARRIED OUT BY VENCHI S.P.A. AS AN INDEPENDENT DATA CONTROLLER, PURPOSES OF PROCESSING AND LEGAL BASIS
In particular, personal data may be collected by the Data Controller through the following channels:
1. the Venchi.com website, in the Italy (https://it.venchi.com/), Europe (https://eu.venchi.com/) and United Kingdom (https://uk.venchi.com/) sections (hereinafter, the “Website”), should the data subject decide to create their own e-commerce account whilst simultaneously joining the European “V-CLUB” Loyalty Programme (“Loyalty Programme” or “Programme”), or for the purchase of products without any registration and, therefore, without using their own e-commerce account or a V-CLUB profile (via the so-called “Guest Profile”). Please note that, with regard to personal data collected by Venchi US Inc. via the US section https://us.venchi.com/ of the Venchi.com website and the simultaneous enrolment in the US “V-CLUB” Loyalty Programme, Venchi US Inc. acts as an independent data controller and, therefore, please refer to the privacy policy drawn up by Venchi US Inc. and available on the website https://us.venchi.com/;
2. Venchi shops located in Italy, Europe and the United Kingdom (hereinafter, the “Shops”), should the data subject decide to join the European “V-CLUB” Loyalty Programme (“Loyalty Programme” or “Programme”), or when purchasing products without registering. Please note that, with regard to personal data collected by Venchi US Inc. through its shops located in the USA and in connection with enrolment in the US “V-CLUB” Loyalty Programme, or for the purchase of products without registration, Venchi US Inc. acts as an independent data controller; please therefore refer to the privacy policy drawn up by Venchi US Inc. and available on the website https://us.venchi.com/;
3. the use of the ‘Contact Us’ and ‘Careers at Venchi’ sections, as well as the use of the Venchi Chatbot on the Website (‘Contact Us, Careers at Venchi and Venchi Chatbot’);
4. by subscribing to the newsletter to receive commercial communications from the Data Controller (“Newsletter”).
hereinafter collectively referred to as the “Channels”.
With regard to each Channel, the Data Controller collects and processes certain personal data for the following purposes, in accordance with the specified legal bases for processing.
A. Registration on the Website
By registering on the Website, the user creates their own personal e-commerce account, to which their purchases on the Website will be linked, and simultaneously subscribes to the Programme (for further information on which, please refer to paragraph 2.C below). In doing so, Venchi may collect the following personal data:
a) personal details (first name, surname);
b) email address;
c) country of residence (if the e-commerce account is created in-store);
d) postcode of domicile or residence;
e) date of birth;
f) telephone number.
The provision of the data referred to in points (a), (b) and (c) above is mandatory for the purposes of completing registration on the Website and, therefore, creating your e-commerce account. Without this data, it will not be possible to complete registration on the Website and, consequently, to place orders using your personal e-commerce account. The provision of the data referred to in points (d), (e) and (f), on the other hand, is at the user’s discretion. The Data Controller uses this data solely for the purpose of categorising users who register on the Website in greater detail, as well as for the purposes set out below, in accordance with the relevant legal basis.
With regard to the data required for joining the Loyalty Programme, please refer to the provisions of paragraph 2.C below.
With specific reference to the telephone number, the Data Controller specifies that, should the user freely decide to provide their telephone number and also consent to receiving commercial communications (as further defined in paragraph “2.E.1. Commercial Communications (General Marketing, Profiled Marketing and Third-Party Marketing)’ below), this data will be used to send Commercial Communications via SMS (as further defined in paragraph 2.E.1 below).
Furthermore, when placing an order for products, the following additional information will be requested, which is mandatory in order to complete the order:
a) delivery address;
b) payment details, credit/debit card number and the first name and surname associated with it, credit/debit card expiry date, and billing address.
Should the user wish to receive an electronic invoice following a purchase, the personal data provided to request electronic invoicing (including the tax identification number) will be processed by the Data Controller using the same methods as set out above for the purpose of issuing the invoice. The provision of invoicing details is optional; however, refusal to provide such details will make it impossible to issue an electronic invoice.
Each Data Controller will process the personal data referred to above for the following purposes and on the following legal bases:
(i) To create your e-commerce account and perform the contract to which you are a party (in order to complete an order for products and, where applicable, request electronic invoicing) or to take pre-contractual measures at your request, as well as to comply with legal obligations and/or for accounting purposes related to the contract, and to enable the Data Controller to exercise its right of defence. The legal basis for the processing is therefore the performance of a contract, compliance with a legal obligation and the pursuit of a legitimate interest pursuant to Article 6(1)(b), (c) and (f) of the GDPR.
(ii) To enrol you in the Loyalty Programme, to send you communications relating to the Programme and to enable you to enjoy any related benefits, in accordance with Article 6(1)(b) of the GDPR, as further described in paragraph 2.C below;
(iii) Where you give your independent and specific consent, to send you general marketing communications (as further described in paragraph 2.E.1.a below) and to track your interactions with such communications using tracking pixels and similar tools, as described in paragraph 2.F below. The legal basis for the processing is therefore the user’s consent, pursuant to Article 6(1)(a) of the GDPR and, with regard to the use of tracking pixels, Article 122 of Italian Legislative Decree No. 196/2003 (‘Privacy Code’);
(iv) where you give your independent and specific consent, to analyse your consumption habits and related purchasing choices, as well as – provided you have not withdrawn your consent to tracking – information relating to your interactions with the Data Controller’s email communications (as described in paragraph 2.F below), and consequently to carry out personalised marketing activities, both through Venchi sending you commercial communications in line with your preferences (as further described in paragraph 2.E.1.b below), and by including you in advertising campaigns relating to Venchi carried out on other platforms (for example, social media) by Venchi’s suppliers, who have been duly appointed as data processors by Venchi and to whom Venchi has disclosed your data in that capacity, for the purpose of you receiving targeted advertising relating to Venchi. The legal basis for the processing is therefore your consent pursuant to Article 6(1)(a) of the GDPR;
(v) Where you give your independent and specific consent, Venchi may send you commercial communications for the purpose of promoting and/or advertising products/services of Venchi’s commercial partners (as further described in paragraph 2.E.1.c) below). The legal basis for the processing is therefore your consent, in accordance with Article 6(1)(a) of the GDPR;
(vi) To send you, on the basis of the Data Controller’s legitimate interest, marketing communications in line with purchases you have already made, as further described in paragraph 2.E.2. below, in accordance with Article 6(1)(f) of the GDPR. These communications do not contain tracking pixels that allow your interactions to be tracked individually, unless you have given the consent referred to in point (iii) above;
Personal data will be stored and shared in accordance with the provisions set out in the following paragraphs “5. Recipients of personal data and place of processing” and “6. Duration of processing and data retention period”.
You may cancel your membership of the Loyalty Programme at any time, in accordance with its terms and conditions. In such cases, your personal data will be processed by the Data Controller solely for purposes relating to your registration on the Website (through the creation of your e-commerce account) and related purchases made via the Website. In any event, you may at any time (i) delete your personal e-commerce account created for the purpose of registering on the Website, and/or (ii) withdraw the consents previously given pursuant to points (iii), (iv) and (v) above, and/or (iii) withdraw your consent solely to the tracking of your interactions with email communications, whilst continuing to receive marketing communications, in accordance with the procedures described in paragraph 2.F.4 below, by contacting the Data Controller at privacy@venchi.com or customercare@venchi.com; You will then receive confirmation that your consents have been cancelled or withdrawn.
With regard to browsing the Website, please note that we use cookies and similar technologies to facilitate your browsing experience, understand how you interact with us and, in some cases, to display advertisements based on your browsing habits or to combine such data with other internal processing in order to enrich your user profile. Please read our cookie policy at it.venchi.com/cookie-policy to understand in detail how the cookies and similar technologies we use work, their respective purposes and other relevant information. The processing of data collected via tracking pixels and similar tools included in email communications is described in paragraph 2.F below.
B. Purchases through the Website using a “Guest Profile”
Users who wish to purchase products without creating a profile on the Website may proceed as a guest. In this regard, you will be required to provide your personal details (first name and surname), contact details (email address), telephone number, and the information necessary for delivery and payment.
Unless you give your separate consent, the information provided will be processed solely for the purposes set out in paragraph 2.A, points (i), limited to the completion and fulfilment of the purchase order placed and compliance with related legal obligations, and (vi); with regard to the purpose referred to in point (vi), please note that only the email address provided by the user in connection with purchases made will be used.
Personal data will be stored and shared in accordance with the provisions set out in the following paragraphs: “5. Recipients of personal data and place of processing” and “6. Duration of processing and data retention period”.
C. Enrolment in the Loyalty Programme
As part of the Programme, the Data Controller will process the following personal data of data subjects:
a) personal details (first name, surname);
b) email address;
c) country of residence (if enrolment in the Programme takes place in-store);
d) postcode of domicile or residence;
e) date of birth;
f) telephone number.
The provision of the data referred to in points (a), (b) and (c) above is mandatory in order to complete registration for the Loyalty Programme and, therefore, to create your loyalty profile. Without this data, it will not be possible to complete registration for the Loyalty Programme. The provision of the data referred to in points d), e) and f), on the other hand, is at the user’s discretion.
Within the context of the Loyalty Programme, the Data Controller will process the personal data listed above for the following purposes and on the following legal bases:
(i) To process your registration for the Loyalty Programme, to send you, as a member, communications relating to the Programme and to enable you to benefit from any associated advantages, in accordance with Article 6(1)(b) of the GDPR;
(ii) Where you give your independent and specific consent, to send you general marketing communications as further described in paragraph 2.E.1.a) below, in accordance with Article 6(1)(a) of the GDPR;
(iii) where you provide your independent and specific consent, to analyse your consumption habits and related purchasing choices and, consequently, to carry out personalised marketing activities, either through Venchi sending you commercial communications in line with your preferences (as further described in paragraph 2.E.1.b below), and by including you in advertising campaigns relating to Venchi carried out on other platforms (for example, social media platforms) by Venchi’s service providers, duly appointed as data processors by Venchi and to whom Venchi has disclosed your data in that capacity, for the purpose of you receiving targeted advertising relating to Venchi, in accordance with Article 6(1)(a) of the GDPR;
(iv) where you provide your independent and specific consent, the Data Controller may send you commercial communications for the purpose of promoting and/or advertising the products/services of Venchi’s commercial partners (as further described in paragraph 2.E.1.c below), in accordance with Article 6(1)(a) of the GDPR.
If you enrol in the Loyalty Programme, the consents to receive the aforementioned commercial communications are optional, and you may in any case enrol in the Programme even without providing them; you may also, at any time thereafter, withdraw any consents previously given, without this affecting the lawfulness of the processing based on the consent given prior to the withdrawal. If you do not give such consents or withdraw them, you will continue to receive only emails relating to the Programme and the benefits you have accrued, as these are inherent to your enrolment.
The emails relating to the Programme referred to in point (i) above may contain tracking pixels that allow your interactions to be tracked individually only if you have given the consent described in paragraph 2.F and have not withdrawn it. Otherwise, such communications will be sent to you without any individual tracking tools. Refusal or withdrawal of consent to tracking does not entail any restriction on participation in the Programme or on the enjoyment of the associated benefits.
Personal data will be stored and shared in accordance with the provisions set out in the following paragraphs: ‘5. Recipients of personal data and place of processing’ and ‘6. Duration of processing and data retention period’.
D. Use of the ‘Contact Us’, ‘Careers at Venchi’ and Venchi Chatbot sections
The user may contact the Data Controller via the “Contact” section on the Website. The personal data provided by the user, such as first name, surname, email address (mandatory for the purpose of submitting the enquiry) and telephone number (optional for the purpose of submitting the enquiry), as well as the reason for contact and any further personal data included in the text of the enquiry, submitted by completing the form on the Website, will be processed for the purpose of responding to the enquiry sent by the user. The legal basis for this processing is the performance of a contract to which the user is a party, or the implementation of pre-contractual measures taken at the user’s request, or compliance with legal obligations, in accordance with Article 6(1)(b) and (c) of the GDPR.
The user may also contact the Data Controllers via the Venchi Chatbot to request and obtain assistance – by way of example only – to obtain information regarding their order, the products and services provided by Venchi, etc. The personal data collected and processed in connection with the use of this tool are exclusively those that may be contained within the interactions between the user and the Venchi Chatbot; these are therefore provided voluntarily by the user when using the Venchi Chatbot for the purpose of the Data Controllers handling their enquiry. In this regard, each Data Controller collects only the information that the user enters as input in order to receive a response. It should also be noted that the provision of personal data will only be necessary for the handling of certain enquiries (for example, in the case of enquiries relating to an order placed by the user, the user will be asked to provide the relevant order number). In any case, it is specified that the provision of personal data is not mandatory. However, failure to provide personal data, or the provision of incomplete or inaccurate data, may make it impossible for the Data Controllers to provide the requested services or to process any requests made by the user via this tool; the user must therefore, if they so wish, contact each Data Controller using alternative means of communication. The personal data provided will be processed for the purpose of responding to the user’s enquiry, and the legal basis for this is the performance of a contract to which the user is a party, or the implementation of pre-contractual measures taken at the user’s request, or compliance with legal obligations, in accordance with Article 6(1)(b) and (c) of the GDPR.
Interactions between the user and the Data Controller via the Venchi Chatbot may also be processed in an anonymised form for the purpose of improving the effectiveness of the Venchi Chatbot, so that, over time, it provides increasingly appropriate, comprehensive and relevant responses to users’ enquiries.
The user may also contact the Data Controller by submitting their application and CV to the email address provided in the “Careers at Venchi’ section of the Website. The personal data provided (contact details, information relating to professional qualifications and other data contained in the CV) will be processed solely for recruitment purposes, to enable the Data Controller to assess users’ applications for job vacancies and to contact them where necessary. The provision of data is optional; however, failure to provide such data will prevent us from considering your application. Should you provide us with special categories of data (as listed in Article 9 of the GDPR, such as data relating to health, racial or ethnic origin, or trade union membership) in order to process your application, such data will be processed in accordance with Article 9(2)(b). The legal basis for the processing of ordinary personal data is the implementation of pre-contractual measures taken at the user’s request in accordance with Article 6(1)(b) of the GDPR; for the processing of special categories of personal data, the legal basis is the need to fulfil the obligations and exercise the specific rights of the data controller or the data subject in matters of labour law, social security and social protection, in accordance with Article 9(2)(b) of the GDPR.
Personal data will be retained and shared in accordance with the provisions set out in the following sections: “5. Recipients of personal data and place of processing” and “6. Duration of processing and data retention period”.
E.1. Commercial Communications (General Marketing, Profiled Marketing and Third-Party Marketing)
Upon registering for one of the Programmes and simultaneously registering on the Website, users may also, at their own discretion and therefore on a strictly voluntary basis, give their consent to receive Commercial Communications from Venchi and/or targeted advertising relating to Venchi, including – for the sake of clarity – through their inclusion in advertising campaigns carried out on other platforms (for example, social media) which involve an analysis of your consumption habits and related purchasing choices.
a) In this regard, the user may give their explicit consent to receive general commercial communications (“General Marketing”) from Venchi, including newsletters containing informative, promotional, commercial and advertising material relating to Venchi products, as well as invitations to events and notifications of any extraordinary shop openings or closures, catalogues and invitation cards to Venchi events and special promotions. The processing of personal data for the purpose of sending General Marketing communications will only be possible with the user’s explicit consent, given by ticking the relevant box, in accordance with Article 6(1)(a) of the GDPR. Consent to General Marketing also includes consent to the use, in email communications, of tracking pixels and similar tools that enable us to track your individual interactions with such communications, as described in paragraph 2.F below. You may at any time withdraw your consent to tracking alone, whilst continuing to receive commercial communications, in accordance with the procedures set out in paragraph 2.F.4. Providing your email address for these purposes is optional; however, if you do not provide it, your request to subscribe to the service for receiving general commercial communications cannot be fulfilled. Please note that, should you have given your consent to receive general marketing communications and have also chosen to provide your telephone number when registering for the Loyalty Programme, this data will also be used for the purposes of the aforementioned general marketing activities, by sending the aforementioned marketing communications via SMS. The user may, at any time, request that their telephone number no longer be used for these purposes by exercising their right to erasure of this specific data, in accordance with the procedures described below.
b) The user may also give their explicit consent to profiling (analysis of their consumption habits and related purchasing choices, categorisation among individuals with similar characteristics, and automated processing for this purpose) and to receiving profiled commercial communications, other than those referred to in paragraph 2.E.2 below, including newsletters personalised in line with the user’s preferences, characteristics and consumption and purchasing habits, as well as their behavioural data (for example, if the user has expressed an interest in a particular product, we may send them this type of communication again in the future, assuming it is of interest to them, or offer them dedicated commercial offers), in order to provide the user with an increasingly personalised service that aligns as closely as possible with their personal tastes and, for the sake of clarity, to receiving targeted advertising through the inclusion of the user’s profile in Venchi-related advertising campaigns carried out on other platforms (for example, social networks) by Venchi’s suppliers, who have been duly appointed as data processors by Venchi and to whom Venchi has disclosed the user’s data in that capacity, so that the user may receive targeted advertising relating to Venchi, including on other platforms (“Profiled Marketing”). Behavioural data that may be used for Profiled Marketing may also include information relating to interactions with the Data Controller’s email communications, collected via tracking pixels and similar tools (for example, opens and clicks), provided that the user has given consent to tracking, has not withdrawn such consent, and has also given consent to Profiled Marketing. This information may be associated with other information available in the user’s profile and used to assess their level of engagement, understand their interests, define segments and personalise content, offers, frequency and timing of subsequent communications. This information, and any segments derived from it, may also be used, provided you have given your consent to Profiled Marketing, for the purposes of including or excluding you from advertising campaigns relating to Venchi carried out on other platforms, such as social networks, as well as for the creation of custom or lookalike audiences, in accordance with the procedures described in this paragraph.
The processing of personal data for the purposes of profiling and the consequent receipt of profiled commercial communications will only be possible with the user’s explicit consent, given by ticking the relevant box, in accordance with Article 6(1)(a) of the GDPR. Providing your email address for these purposes is optional; however, if you do not provide it, we will be unable to fulfil your request to subscribe to the service for receiving personalised marketing communications.
Please note that, should the user have given their consent to receive Profiled Marketing communications and have also chosen to provide their telephone number when signing up to the Loyalty Programme, this data will also be used for the purposes of the aforementioned Profiled Marketing activities, by sending the aforementioned commercial communications via SMS. The user may, at any time, request that their telephone number no longer be used for these purposes by exercising their right to erasure of this specific data, in accordance with the procedures described below.
It is also clarified that, with regard to all Profiled Marketing activities, including the analysis inherent therein, you will not be asked to provide any new or specific data, as Venchi will pursue this additional purpose, where necessary, by processing data already collected for other purposes deemed compatible with this one (including your registration for the Loyalty Programme, if applicable).
c) The user may also give their explicit consent for the Data Controller to send commercial communications promoting or advertising products/services from Venchi’s third-party partners (“Third-Party Marketing”). The processing of the user’s personal data for the purpose of sending Third-Party Marketing communications will only be possible with the user’s explicit consent, given by ticking the relevant box, in accordance with Article 6(1)(a) of the GDPR. Third-Party Marketing emails sent by the Data Controller may contain tracking pixels and similar tools under the conditions described in paragraph 2.F below. Providing your email address for these purposes is optional; however, if you do not provide it, your request to subscribe to the service for receiving third-party commercial communications cannot be fulfilled. Please note that, should the user have given their consent to receive third-party marketing communications and have also chosen to provide their telephone number when registering for the Loyalty Programme, this data will also be used for the aforementioned third-party marketing activities, by sending the said marketing communications via SMS. Should the user wish to prevent their telephone number from being used for these purposes, they must contact the aforementioned third parties in accordance with the procedures set out in their respective privacy policies.
Personal data will be stored and shared in accordance with the provisions set out in the following sections: “5. Recipients of personal data and place of processing” and “6. Duration of processing and data retention period”.
The user may withdraw at any time the consents previously given for General Marketing, Profiled Marketing and/or Third-Party Marketing, as well as consent solely to the tracking of interactions with email communications, in one of the following ways:
• By using the link at the bottom of the email communications received, via which you can access the area dedicated to managing your preferences and amend the choices you have previously made;
• By unsubscribing via the unsubscribe link at the bottom of the communications received (any further instructions will be provided directly within the communications you receive from the Data Controller). By following this unsubscribe procedure, the user will simultaneously withdraw all previously given consents for commercial communications, unless otherwise specified;
• With specific reference solely to the tracking of interactions with email communications, in accordance with the procedures set out in paragraph 2.F.4 below, which allow you to continue receiving commercial communications without your interactions being tracked individually;
• By sending a request to this effect to the email addresses privacy@venchi.com and customercare@venchi.com, in which you may specify which specific consent previously given you wish to withdraw.
In any event, any such withdrawal shall not affect the lawfulness of the processing activities carried out by the Data Controller up to that point, nor the lawfulness of processing activities carried out on the basis of consents that have not been expressly withdrawn.
Withdrawing consent to receive marketing communications does not in itself result in the deletion of the user’s personal profile on the Website; such deletion must be carried out in accordance with the procedures set out in the preceding section “2.A Registration on the Website”.
E.2. Commercial communications relating to previous purchases
The Data Controller may also send you emails regarding Venchi-branded products similar to those you have already purchased, by virtue of Venchi’s legitimate interest in this regard, as provided for in Article 130(4) of the Personal Data Protection Code – Legislative Decree No. 196/2003 (so-called ‘soft spam’). The Data Controller’s interest stems from a business’s general interest in promoting its products and is considered legitimate because it is in line with the reasonable expectations of the data subjects, taking into account the relationship between them and the Data Controller.
Therefore, as this processing is based on the Data Controller’s legitimate interest pursuant to Article 6(1)(f) of the GDPR, no explicit consent from the user is required for such processing. However, legitimate interest does not constitute a valid basis for the use of tracking pixels that allow for the individual tracking of interactions with communications. The emails referred to in this paragraph therefore do not contain such individual tracking tools, unless you have given the consent described in paragraph 2.F and have not withdrawn it. In any event, you may at any time choose not to receive further communications of this kind by exercising your right to object in accordance with the law, by sending a request to this effect to privacy@venchi.com and customercare@venchi.com or by using the unsubscribe link at the bottom of each email.
Any objection to the processing by the user shall not affect the lawfulness of the processing carried out up to that point, nor shall it have any effect on future purchases of Venchi-branded products.
F. Use of tracking pixels and similar tools in email communications
F.1. What they are and what information they collect
Some email communications sent by the Data Controller via its communications management platform may contain tracking pixels, i.e. very small images, generally invisible, hosted on a remote server and automatically downloaded when the message is opened, provided that the email programme allows images to be loaded. The communications may also contain hyperlinks that enable the detection of clicks on the relevant content (hereinafter collectively referred to as ‘Tracking Tools’).
Depending on the circumstances, Tracking Tools enable the detection of: whether the communication has been opened; the date and time of opening; the number of times it has been opened; clicks on links contained in the communication, including the date and time of the click and the link selected; the IP address; technical information such as device type, operating system and email programme; approximate location data derived from the IP address. Tracking Tools do not allow us to ascertain the content of your correspondence.
The tracking carried out by the Data Controller is individualised: the information collected relates to the individual recipient and may be linked to their customer profile, including information relating to purchases made following receipt of the communication.
F.2. Communications concerned, purposes and legal bases
Commercial communications and communications relating to the Loyalty Programme. Communications relating to General Marketing, Profiled Marketing and Third-Party Marketing, including newsletters, as well as communications relating to the Loyalty Programme, may contain individual Tracking Tools only if you have given your consent. These Tools are used to:
• measure the effectiveness of individual campaigns using metrics such as open rates, click-through rates and purchases or revenue attributed to the campaign in accordance with the attribution criteria adopted by the Data Controller;
• carry out activities based exclusively on interactions with email communications, including segmentation or automation based solely on interactions with email communications;
• where you have also given your consent to Profiled Marketing, analyse your customer journey and your level of engagement with the communications received, as well as carry out analysis, segmentation and engagement scoring;
• where you have also given your consent to Profiled Marketing, to personalise content, offers, the frequency and timing of communications, and to define segments and communication pathways, as described in paragraph 2.E.1(b).
The legal basis is your consent, in accordance with Article 122 of the Privacy Code and Article 6(1)(a) of the GDPR. As provided for in paragraph 2.E.1(a), this consent is included within the consent to receive marketing communications and may be withdrawn separately at any time, whilst continuing to receive such communications. The use of the information collected for profiling purposes also requires consent to Profiled Marketing. In the absence of, or in the event of withdrawal of, consent to tracking, communications are sent without individual Tracking Tools and no individual open or click events are collected.
F.3. Recipients already on the Data Controller’s mailing lists
If you are already receiving email communications from the Data Controller on the basis of a valid legal ground that was already in place when the Data Protection Authority’s Guidelines came into force, the Data Controller, in accordance with the transitional arrangements provided for therein, will inform you of the use of Tracking Tools in the first appropriate communication and will allow you to withdraw the consent previously given – even if only in relation to tracking – in accordance with the procedures set out in paragraph F.4.
F.4. How to withdraw consent to tracking
You may withdraw your consent to tracking at any time, whilst continuing to receive communications from the Data Controller without your interactions being tracked individually:
• by using the link at the bottom of the email communications you receive, via which you can access the area dedicated to managing your preferences and separately amend your choices regarding marketing, tracking and profiling;
• by sending a request to privacy@venchi.com or customercare@venchi.com, specifying that you wish to continue receiving communications without being tracked.
The Data Controller will record your choice and apply it to subsequent communications. If, however, you no longer wish to receive any commercial communications, you may use the unsubscribe link at the bottom of each communication, as set out in paragraph 2.E.1. Withdrawal of consent does not affect the lawfulness of processing carried out prior to its withdrawal. With regard to data already collected, processing based on the withdrawn consent shall cease; the data shall be erased when there is no independent and valid basis justifying its further retention. This is without prejudice to the records necessary to document the data subject’s choices and the Data Controller’s compliance with its obligations, which shall be retained for the time strictly necessary.
Refusal or withdrawal of consent to tracking does not entail any restriction on the use of the Data Controller’s services, including the Loyalty Programme and its associated benefits, and does not affect the lawfulness of processing carried out prior to the withdrawal.
For the retention periods of information collected via Tracking Tools, please refer to paragraph 6 below.
3. JOINT CONTROLLERSHIP PROCESSING ACTIVITIES
The Joint Controllers, as identified in paragraph 1 of this Privacy Notice, have entered into a Joint Controllership Agreement pursuant to Article 26 of the GDPR. Through this agreement, Venchi S.p.A. and Venchi US Inc. intend to jointly process the data collected in the course of their activities. Specifically, these activities involve the creation of a joint CRM database containing the personal data of data subjects participating in the European or US Programmes, which may be viewed and managed by each Joint Controller. The CRM database will also include, as further categories of data subjects, (i) individuals who have subscribed exclusively to the newsletter and/or (ii) individuals who, in the past, have merely created an account on the website without engaging in any further interactions. The joint CRM database also includes information relating to interactions with email communications collected via the Tracking Tools referred to in paragraph 2.F, within the limits and subject to the conditions described therein, including the relevant consent status for tracking. This information may therefore also be accessible to Venchi US Inc. in its capacity as Joint Controller.
These activities are designed to enable each Joint Controller to analyse users’ information in relation to their participation in the respective Programmes. This makes it possible to offer targeted promotions and benefits, improve the management of each Programme, facilitate interactions with customers and optimise the overall user experience. Furthermore, the joint processing of data enables users enrolled in the Programmes to earn points even through purchases made within the territory covered by the other Programme, thereby promoting a cross-programme loyalty experience.
Data subjects may consult an extract containing the main provisions of the Joint Controllership Agreement in the annex at the end of this Privacy Notice.
The legal basis for this processing lies in the legitimate interest of the Joint Controllers in creating a joint CRM database in order to enable each Joint Controller to analyse user information to optimise the Programmes, offer personalised benefits and improve the overall experience. This legitimate interest does not prejudice the rights and freedoms of data subjects, as it is balanced against the data subjects’ interest and reasonable expectation of benefiting from an optimised and personalised experience within the Programmes.
For the aforementioned purpose, the Joint Controllers have also jointly determined, within the framework of the specific agreement, the methods of processing and have clearly and transparently defined the procedures for providing you with a prompt response should you wish to exercise your rights, as provided for in Articles 15, 16, 17, 18 and 21 of the GDPR, as well as in cases of personal data portability provided for in Article 20.
4. METHODS OF PROCESSING
The processing of personal data as described in the preceding paragraphs may be carried out using paper-based and/or digital methods, employing organisational and logical procedures strictly related to the stated purposes.
Personal data will be processed by Venchi employees who have received specific training in personal data protection, as well as by third-party suppliers and companies within the Venchi Group or service providers acting on behalf of the Data Controller as Data Processors, specifically designated in accordance with Article 28 of the GDPR.
Data subjects may, at any time, request information regarding the data processors engaged by contacting the Data Controller via the contact details set out in paragraph 8 below.
5. RECIPIENTS OF PERSONAL DATA AND PLACE OF PROCESSING
Your personal data may be shared with:
1. Companies within the Venchi Group;
2. Venchi staff and service providers for the purposes of processing and managing your orders;
3. Venchi staff, logistics service providers, couriers and freight forwarders for the purpose of dispatching products;
4. banks and payment service providers for the management of collections and payments arising from the performance of contracts with you;
5. Venchi staff and service providers for the creation and maintenance of the Website and its features and, in general, IT service providers;
6. Venchi staff and service providers for the management and hosting of databases;
7. Venchi staff and service providers for the assessment of job applications submitted by users and for contacting them where necessary;
8. legal, administrative and tax advisers, banks, companies, bodies, consortia or credit protection associations;
9. where applicable, Venchi staff, service providers and collaborators involved in marketing and advertising, such as websites, social networks, advertising agencies or advertising partners, including in relation to segments or other information derived from the user’s interactions with email communications, where used for the creation of personalised advertising campaigns and in accordance with the consents given by the user;
10. providers of platforms for sending email communications and marketing automation, as well as the e-commerce platform, who act as data processors pursuant to Article 28 of the GDPR, including in relation to data collected via the Tracking Tools referred to in paragraph 2.F.
The processing of your personal data may also be carried out by parties (whether internal or external to the Data Controller) whose registered office or place of data processing is not located in a Member State of the European Union or in another State party to the Agreement on the European Economic Area. In such cases, we ensure prior to the transfer that, unless otherwise permitted by law, the party carrying out the processing guarantees an adequate level of data protection (for example, by operating in a country that guarantees an adequate level of data protection pursuant to an adequacy decision by the European Commission as referred to in Article 45 of the GDPR, through appropriate safeguards pursuant to Article 46 of the GDPR or by entering into the so-called EU standard contractual clauses with the data importer, pursuant to Article 46(2)(c) of the GDPR, or, alternatively, by fulfilling the obligations and implementing the safeguards provided for in Article 49(1) of the GDPR) or you have given your consent to such data transfer in accordance with Article 49(1)(a) of the GDPR.
In particular, with regard to processing carried out under joint controllership, the Joint Controllers process the personal data of data subjects for the purposes indicated above, with the possibility of sharing and transferring data from the European Union to the United States and vice versa.
In this context, each Joint Controller may act as both a data exporter and a data importer, ensuring an adequate level of protection in accordance with Article 45 of the GDPR. To this end, data transfers will be governed by the Standard Contractual Clauses (SCCs) in the controller-to-controller version (Module 1), approved by European Commission Decision (EU) 2021/914 of 4 June 2021.
In accordance with Clause 14 of the SCCs, a data protection impact assessment (DPIA Loyalty) has been carried out to analyse the risks associated with the cross-border transfer of data and to implement the necessary security measures.
Each Joint Controller undertakes to ensure compliance with the data protection legislation applicable in its own jurisdiction and to cooperate with the authorities and data subjects to respond to any requests relating to transfers of personal data.
In the event of regulatory changes that render the SCCs invalid or affect the legal basis for the transfers, the Joint Controllers shall promptly adopt alternative safeguards to ensure compliance with the GDPR and minimise any impact on the activities of the Programmes.
6. DURATION OF PROCESSING AND RETENTION PERIOD FOR PERSONAL DATA
The user’s personal data will be retained only for the period necessary to fulfil the purposes for which it is processed, or for any other period provided for by applicable legislation. In particular:
A. Registration on the Website and online purchases, and
B. Purchases via the Website as a “Guest Profile”
With the exception of data processed in connection with enrolment in the chosen Loyalty Programme, for which the provisions of paragraph 6.C below apply, personal data provided for the purposes of registering on the Website and the subsequent creation of a personal profile will be retained until the user requests the deletion of their personal profile, subject to any longer period that may be necessary to enable each Data Controller to fulfil its legal obligations, for accounting purposes and/or to exercise its right of defence.
Personal data provided for the purpose of purchasing a product (whether through registration on the Website or via a Guest Profile) or a service will be retained for the entire duration of the contract and for a period of 10 years following its termination.
C. Enrolment in the Programme
Personal data processed in connection with registration for the Programme will be retained for a period no longer than that strictly necessary for the purposes for which it was collected. In particular, the data will be retained for the entire duration of the user’s membership of the Programme and, following termination, for the standard limitation period of 10 years.
D. Use of the ‘Contact Us’, ‘Careers at Venchi’ and Venchi Chatbot sections
Personal data provided by users who contact us via the ‘Contact Us’ section or by using the Venchi Chatbot will be retained for 12 months or for any longer period that may be necessary to resolve the enquiry, or for any longer period required by law.
The information and personal data provided by users who submit their application or CV via the ‘Careers at Venchi’ section will be retained for a period no longer than necessary for the purposes for which they were collected and, in any event, for no longer than 24 months from the date of provision.
E.1. General Marketing, Profiled Marketing and Third-Party Marketing Communications
Personal data voluntarily entered by the user on the Website will be retained, for General Marketing, Profiled Marketing or Third-Party Marketing purposes, in relation to each specific purpose, until the relevant consent is withdrawn and, in any event, for no longer than 36 months from the date on which the specific consent was given or expressly renewed. Information relating to interactions with email communications is subject to a separate retention period, as set out in paragraph 6.F.
You may withdraw at any time the consent previously given for General Marketing, Profiled Marketing and/or Third-Party Marketing, as well as the consent specifically relating to the tracking of interactions with email communications, in one of the following ways:
• by using the link at the bottom of the email communications received, via which the user can access the area dedicated to managing their preferences and amend their previously expressed choices;
• by unsubscribing via the unsubscribe link at the bottom of the communications received (any further instructions will be provided directly within the communications you receive from the Data Controllers). By following this unsubscribe procedure, the user will simultaneously withdraw all previously given consents for commercial communications, unless otherwise specified;
• specifically with regard to the tracking of interactions with email communications only, in accordance with the procedures set out in paragraph 2.F.4, which allow you to continue receiving marketing communications without your interactions being tracked individually;
• by sending a request to this effect to the email addresses privacy@venchi.com and customercare@venchi.com, in which the user may specify which specific consent previously given they wish to withdraw.
In any event, any such withdrawal shall not affect the lawfulness of the processing activities carried out by the Data Controller up to that point, nor the lawfulness of processing activities carried out on the basis of consents not expressly withdrawn.
E.2. Commercial communications relating to previous purchases
For the processing of commercial communications relating to purchases already made by the user, the user’s personal data will be retained until the user exercises their right to object by sending a request to this effect to the email addresses privacy@venchi.com and customercare@venchi.com, through which the user may indicate that they no longer wish to receive the aforementioned commercial communications relating to previous purchases.
F. Data collected via Tracking Tools in email communications
Information relating to interactions with email communications collected via the Tracking Tools referred to in paragraph 2.F.2 is retained for a maximum of 36 months from the date of collection. Where used for Profiled Marketing purposes, such information is not retained beyond the time limit applicable to Profiled Marketing as set out in paragraph 6.E.1.
At the end of the retention periods set out above, your personal data will be completely deleted, aggregated or anonymised so that it can be used in a non-identifiable manner for statistical analysis.
7. RIGHTS OF DATA SUBJECTS
As a ‘data subject’, you may, at any time and where the conditions laid down by law are met, exercise the rights provided for in Articles 15 et seq. of the GDPR.
In particular, you may exercise:
• the right of access: you may request information regarding the processing carried out on your data, as well as receive a copy of the data processed;
• the right to rectification: you may verify the accuracy of your data and request that it be rectified or updated;
• the right to erasure: you may, subject to certain conditions, request the erasure of your data;
• the right to restriction of processing: you may request, subject to certain conditions, that the processing of your data be restricted;
• withdrawal of consent: in all cases where the legal basis for processing is consent, you may withdraw your consent at any time, without prejudice to the lawfulness of any processing carried out prior to such withdrawal. With regard to the tracking of interactions with email communications, you may withdraw your consent solely in respect of such tracking, whilst continuing to receive communications, in accordance with the procedures set out in paragraph 2.F.4;
• right to lodge a complaint with the Data Protection Authority: without prejudice to any other administrative or judicial remedy, you may lodge a complaint with the Data Protection Authority, in accordance with the procedures and guidelines published on the Authority’s website, available at https://www.garanteprivacy.it/.
8. CONTACT DETAILS
To exercise the above rights or to obtain further information on the processing of your personal data, you may contact the Data Protection Officer (DPO) at the Data Controller directly via email at privacy@venchi.com or send a registered letter for the attention of the Privacy Office of Venchi S.p.A., Via V. Monti 8, 20123 Milan (MI).
9. CHANGES TO THE PRIVACY NOTICE
This Privacy Notice is valid from the date indicated in its heading or at the end of the document.
Where deemed appropriate, we may amend and/or supplement the information contained in this policy, including – but not limited to – as a result of any subsequent amendments and/or additions to the GDPR. Any updates and/or amendments will be communicated to you in various ways via the Website (for example, via a banner, a pop-up or a push notification) or by other means determined by each Data Controller, so that you may review the changes, assess them and, where appropriate, object to or cancel any services or features. In any event, we urge you to review this policy regularly to check for any minor changes or interactive improvements, as this policy is always available on our Website.
Last updated: 29/10/2026