Privacy

1 – Introduction

Browsing the PROZIS website and customer registration on the online store from the 03rd October 2023 shall represent the acknowledgment and the acceptance of this Privacy and Data Protection Policy.

PROZIS (collectively, including all the companies belonging to PROZIS GROUP), maintains a constant concern for the protection of the privacy of personal data and a preventive action regarding the security of the website and the protection of the data of its customers and visitors.

To reinforce the guarantees of the confidentiality of personal data, new data protection measures were implemented, both in terms of verifying the legitimacy of the use of personal data processed, as in terms of ensuring compliance with the rights granted to the data subjects. In this context, and through the specialization of customer support channels, PROZIS aims to promote a clearer and more objective communication of the purposes underlying the processing of personal data and the transparency of data processing operations.

Thus, the information contained in this text is intended to convey, clearly and unambiguously, the content of the privacy policy and protection of personal data that will be processed under the terms of the General Data Protection Regulation in force (hereinafter GDPR) and delimited by the content of the business relationship to be established between the data subject and PROZIS.

2 – Processing of personal data

Customers' personal data is processed in accordance with strict procedures that are frequently reassessed in order to guarantee full compliance with the principles that derive from both the applicable legal provisions and the good practices issued at supranational level with regard to the Security and Privacy of Personal Data.

In general terms, personal data are collected in three situations directly arising from PROZIS' activity:

2.1. Customer registration: creating a PROZIS account and determining the purposes for processing personal data

For the purpose of creating the customer account, a personal area is provided in which the customer must enter the data necessary for their identification as a customer. The first purchase will depend on the provision of additional personal data, indispensable for order processing and delivery.

Required fields on the forms available for those registration stages are marked with an asterisk (*).

Confirming the intention of creating a customer account shall mean that the data indicated to that aim is accurate and up-to-date, as well as the acknowledgment that PROZIS may, at any moment, suspend the account, including any transactions in progress, if there is a founded suspicion that the data provided is not compliant and the Customer fails to rectify it when requested to do so.

At the latest when the first order is placed, the customer must provide the personal details deemed necessary for the order to be processed and delivered correctly.

PROZIS is committed to protecting customer data which will never be made available to third parties without the acknowledgment or consent of the data subject, as legally required.

PROZIS has concluded confidentiality and data protection agreements with the companies in the group of companies to which it belongs, insofar as they provide support services for the management of the sales process and the distribution of the products in the online shop, as well as with all other entities that provide support services for the operation of the functionalities and applications that customers wish to use. All entities, whether they have a direct subcontracting relationship with the data controller, or an indirect one due to the subcontracting relationship with the subcontractor and authorised by the latter, will also be required to comply with the GDPR, under the provisions applicable to the processing of personal data on behalf of third parties. In addition, when making a purchase on the site, customers will also be asked to provide their delivery address and payment details in order to promote maximum efficiency and ensure that delivery times are met. Those data will be transmitted to the companies abovementioned, as well as to the carrier who will guarantee the delivery operation. This data will be passed on to the companies in the aforementioned group, as well as to the forwarding agent who will guarantee delivery of the order, all of whom are obliged to process this data in strict compliance with the principles applicable to the protection of personal data.

In the course of processing the customer's order, it is also possible that certain personal data - such as address and postcode - may be communicated to third parties for the sole purpose of preventing and detecting fraud and always following a request to this effect from the competent authorities. For security reasons, the request itself is subject to a procedure to confirm its authenticity.

For the purposes of implementing other functionalities made available by PROZIS, at the customer’s demand, additional personal data may be requested and processed in accordance with the procedures specifically set out in the conditions of use of such data, without prejudice to the customer's right to be informed of the specific procedures for such processing in response to such request.

The data provided will be kept for the strictly necessary period, which generally corresponds to the duration of the customer's account. For this reason, when the customer triggers the deactivation of their account, the personal data will be permanently deleted, with the exception of data to be retained in order to comply with legal obligations, in particular but without limitation, for invoicing and accounting purposes. This data will be stored in a dedicated, pseudonymised database created for this purpose, and only for as long as is absolutely necessary for these purposes. Data relating to transactions carried out during this period using the credit card payment method will also be stored in the same database for a period of twelve months. This record is kept for the purpose of making any refunds due to the customer during these periods, which run from the date of issue of the respective invoices. However, this does not apply to situations where data is kept for reasons of suspected fraud, as described above.

Consequently, once the account has been deactivated, if the customer wishes to place a new order on the site, they must register again, subject to the conditions in force at that time, which will be available in a downloadable version.

Remark: If, after the expiry of the aforementioned twelve months, a refund is required and the account has already been deactivated, the customer must contact Customer Services, providing new bank details and presenting an original, official bank statement. Only bank statements on which the customer is identified as the sole or main holder of the new bank account will be accepted.

Completion of the customer's registration will trigger a registration confirmation for the email address that the customer has associated with the customer account, which will include a hyperlink to this text.

Every feature or platform that PROZIS may possess and which the customer intends to use will be subject to acceptance of the respective conditions of use and, where applicable, the respective privacy and data protection policy. All matters not covered by the aforementioned texts will be governed, with the necessary adaptations, by the conditions set out in this document.

With regard to the accuracy of the customer's data and the respective register, whenever the customer wishes to check the data provided to PROZIS, they can do so in the Account details tab. Customers must keep their account access codes securely, as any action or request made via the account is their responsibility.

Remark: For security and protection of personal data reasons, we recommend that customers do not save their password in their browser, as someone else who has access to their devices may be able to access their personal information.

What is the purpose of the data collected?

Customer data is processed for purposes such as processing orders, notifying customers of any changes to the functionalities of the website, conducting surveys and evaluating interactions for statistical purposes.

Other information concerning the customer's experience on the website may also be collected for the sole purpose of improving the service provided to the customer. However, this will only be done once it has been confirmed that the respective owner has been informed or, where applicable, express consent has been obtained, particularly with regard to the services and functionalities made available by PROZIS via the website or any other app it owns. For the purposes of assessing and certifying the quality of the service and the effectiveness of the response offered by PROZIS, the relevant information may be shared with entities specialised in this field, namely Trustpilot A/S, on the basis of the legitimate interest of PROZIS. For this reason, the customer will be guaranteed the right to object to the processing of the data transmitted in this context (e-mail address and order number). To this end, an opt-out option will be provided in the request for evaluation of the purchasing experience, without prejudice to the customer's right to make a request directly to PROZIS’ customer service or to the Data Protection Officer (via email sent to [email protected]).

Customers may periodically receive information on products and services, campaigns, promotions and special offers by email. If customers do not wish to be contacted for these purposes, they may unsubscribe from the newsletter by clicking on the "Manage permissions" tab in the "Account details" area or by clicking on the link available for this purpose in the text of the newsletter.

2.2. Customer contact with PROZIS

Whenever the customer, on their own initiative, contacts PROZIS in order to obtain information, regarding the products, purchase procedures, the status of the order or to report any situation related to the site or to any services provided, PROZIS may need to collect additional personal data for various purposes, which will be specifically communicated in this case, but which may generally fall under the circumstances of confirming the customer's identity and the purpose of the contact.

In order to ensure that the contact is actually being established by the data subject, PROZIS has implemented measures to reinforce the identity of the caller, especially in cases where the contact is established by telephone.

The operator will only continue the call once the purpose and conditions for validating the customer's identity have been clearly and objectively communicated, and once the customer has expressly confirmed their intention to continue the conversation under these conditions.

In this respect, the customer may be asked, for example, to indicate one or more products purchased during previous orders, which the operator will confirm after requesting authorisation to access the purchase history for the last 6 (six) months. Alternatively, and after describing the identity validation mechanism, the operator may send an alphanumeric validation code to the telephone contact or e-mail address registered in the customer's account, which will then be required by the operator to continue the conversation.

Once the customer's identity has been validated, the operator will ask key questions based on the description of the purpose of the contact to frame the situation and possibly pass it on to the appropriate Customer Service operator.

Any recording of the call to assess the quality of the service will depend on the customer's prior and express consent for this purpose.

For each communication established between the customer and the customer service and as soon as the situation that led to the customer's contact with PROZIS is considered resolved, the customer will be sent a message confirming the update of the complaint or the status of their request. Personal data associated with the initial contact will be retained for a maximum period of 36 months, after which it will be permanently deleted. In certain cases, upon completion of the process, a request for assessment of the service provided, with an optional reply, will be sent. Accordingly, and if the customer expressly consents, the customer's opinion on the level of satisfaction with the service provided will be stored. This specific registry will not imply the storage of any personal data, but only the level of satisfaction but using a proper pseudonymisation procedure.

2.3. PROZIS contact with the customer

When processing a specific order, there may be a need for PROZIS Customer Service to contact the customer in order to:

i) promote the confirmation or rectification of any of the personal data required to complete the delivery process (e.g. the delivery address). In such cases, contact will be made to the mobile phone number on the customer file. Once the connection has been established, the operator will confirm the caller's identity by following, if necessary, the procedure described on the clause 2.2. above.

ii) inform the customer that a message has been sent to his or her mailbox in the customer account as a result of the stockout of one or more items in the order concerned and that, as an alternative to unavailable products, the amount paid back or similar products may be returned, as provided for in the clause 1.4. of the General Conditions of Sale. iii) request for clarification on the content of any message sent by the customer or regarding conversations already in progress. In either case, such contact will be followed by a written message confirming the content addressed and / or any fact eventually agreed upon.

2.4. Collection of data via Cookies and/or other MarketingTools

Cookies are small files stored on a device, such as a computer, a mobile device or any other device that can store information that can be used for one or multiple purposes – e.g. to remember users and their previous interactions with PROZIS and to keep track of items of the shopping cart. Information stored in cookies can include personal data, such as an IP address, a username, a unique identifier, or an email address.

2.4.1. Classification and description of the cookies used by PROZIS

Regarding the type:

Essentials – allow you to navigate the site and use its features. Without these cookies, orders cannot be processed.

Non-Essentials, Functionality or Performance - Collect information on how the user uses the site to improve its functionality. They allow you to check which areas are of greatest interest to the customer by measuring the effectiveness of promotional campaigns. In this way, PROZIS can understand which products and promotions are best suited to the client's interests and needs, which will be done through: the elaboration of statistics based on the non-individualized behavior of the client and the consequent use of the site; measuring the effectiveness of advertising campaigns; consequent improvements in navigation, etc., for the sole purpose of improving the site's performance and responsiveness. For this reason, performance cookies provided by authorized third parties are also used for the purposes stated herein.

Analyticals - used anonymously for statistical purposes and for the purpose of improving the functioning of the site without any collection of personal information. They allow you to highlight articles that may be of interest to customers or visitors, monitor site performance, determine the most effective method of linking pages, or even why some pages are receiving error messages.

Regarding validity:

Persistent - stored on the client's computer or equipment between browser sessions to maintain settings or preferences and to improve site usage on the next visit. Some of these cookies are provided by authorized third parties, however, with the following purposes: presentation of campaigns and products - considered to be in the customer's interest; retargeting - advertising of PROZIS products on partner or social network websites without storing personal data or user profiles, thus not assuming the transmission of any personal data to third parties because advertising is entirely anonymous.

Session – limited to each user-initiated session, so they expire each time a browser session is ended. They may be aimed at indicating products previously placed in the shopping cart, identifying problems and ensuring a better browsing experience. Some session cookies may also be a guarantee of enhanced security.

· Cookies used by PROZIS