WELCOME TO PIOMBO!

 

This policy statement, issued in accordance with Article 13 of Regulation (EU) 2016/679 (hereinafter the “Regulation” or the “GDPR”), provides you with information on the personal data we collect when you use this website (hereinafter the “Website”) or visit one of our retail outlets. This policy statement also lists the purposes for which we use your personal data and your rights as a Data Subject. You can obtain further information on your personal data by clicking on each paragraph of the policy statement.

With respect to personal data collected for the use of services available on the Website, the OVS Apps and at retail outlets, the Data Controller is OVS S.p.A. with registered office at Via Terraglio No. 17 – 30174 Venezia Mestre, Tax and VAT No. 04240010274 (hereinafter “OVS”).

A complete list of all the purposes for which we collect your personal data is set out below: you can click on each paragraph for further information.

Purpose of processing: to enable browsing through the Website; to perform aggregate statistical analyses in order to monitor the correct functioning of this Website.

The data may be used to ascertain liability in the event of cyber attacks against the Website and its users.

Data processed:data on the connection and browsing on the Website, such as the URI (Uniform Resource Identifier) addresses of requests for resources, the time of request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (success, error, etc.). Other parameters concerning the user's operating system and IT environment are collected for the sole purpose of obtaining anonymous statistical information on the use of the Website and to check that it is functioning correctly, and are deleted immediately after processing.

Legal basis for processing:

  • the provision of services to enable users to browse the Website (Article 6, 1, b of the Regulation)
  • the legitimate interest of OVS in ensuring that its IT systems are functioning properly
  • legitimate interest in investigating whether offences have been committed (including on the basis of a possible legal obligation).

Retention period:

With the exception of cases in which the data are used to ascertain liability in the event of cyber attacks against the Website and its users, the data will be deleted after the period required to provide the services described on the Website.

30 (thirty) days after the date of collection, unless a different retention period is imposed by law or by order of public authorities in connection with investigations of possible cybercrimes.

Purpose of processing: the data you provide to us (by telephone, email, online form, etc.) will be used to respond to your notification, request for information, complaints, or questions regarding product warranty issues and use of our services.

Personal Data processed data required to respond to requests to Customer Care Team (e.g. for assistance via the online form - you will be asked to provide your name and email address). You are absolutely free to decide whether or not to provide your data to us, but if you decide to do so, we ask you to complete this form by providing the required details, because the information is necessary to respond to your notifications or requests for information. If you do not fill in the form or if it is incomplete, we will not be able to respond to you or provide you with the information you requested.

Legal basis for processing:

  • the execution of a contract for the purchase of products or pre-contractual measures adopted in response to your request (Article 6, 1, b of the Regulation);
  • for the chat support service, performance of the service requested (Article 6, 1, b of the Regulation)

Retention Period: the data communicated to us will be retained for the period necessary to respond to you or provide you with the information requested. This applies without prejudice to any different retention period necessary for legal protection purposes.

Purpose of processing:

  • to enable you to purchase products, fulfil obligations and exercise rights arising from a concluded contract (shipping and invoicing of the goods and management of payments, tracking of the dispatch, delivery of the goods, any returns and refunds, etc.);
  • to fulfil legal, regulatory or Community tax or accounting obligations (invoicing, keeping of records and accounts).

Personal Data Processed: contact details (e.g. name, surname, email address, telephone number) and mailing address for goods. OVS does not process data concerning the means of payment indicated by the customer (e.g. credit card number, CVV credit card security code, etc.). These details are collected by the selected payment service provider.

You are absolutely free to decide whether or not to provide your data to us, but if you decide to do so, we ask you to complete all the details indicated as “mandatory” (*) because they are necessary for the purchase of products. If you do not fill in the form or if it is incomplete, you will not be able to proceed with the purchase. Failure to complete the data marked as “optional” will not have any consequences.

Legal basis for processing:

  • execution of the contract of sale (Article 6, 1, b of the Regulation)
  • legal obligation (Article 6, 1, c of the Regulation) => we are obliged to process the data necessary for the purpose of fulfilling legal, regulatory, Community, tax or accounting obligations (invoicing, keeping of records and accounts).

Retention period:

  • the time required to fulfil contractual obligations
  • for purposes related to legal, regulatory or Community tax or accounting obligations (invoicing, keeping of records and accounts) the data will be retained for the period required by law.

Purpose of processing: contacting you – by phone, mail, email, sms, apps, push notifications, social networks and other digital channels – for advertising or commercial communications, as well as conducting market research to assess your degree of satisfaction with our services. Advertising or commercial communications may also concern the various brands owned by OVS. An up-to-date list of these brands may be consulted on the website www.ovscorporate.it

Personal data processed: contact details (e.g. name, surname, email address, telephone number).

Legal basis for processing: for direct marketing purposes. We will only process your data with your consent. You may withdraw your consent at any time by writing to hello@piombo.com , or by accessing your private area or by filling our contact form.

Retention period: until your consent is withdrawn.

Purpose of processing: we will use your personal data for analysis and profiling purposes, in order to improve our business offer from knowledge of customers that visit our stores and the Website, and your consumption habits.

Personal data processed: data on your purchases, personal data such as your country of origin, gender and age, your interaction with OVS through our Website, OVS Apps, and through our social media channels.

Legal basis for processing: for profiling purposes, we will only process personal data with your consent. You may withdraw your consent at any time by writing to hello@piombo.com , by accessing your private area or by filling our contact form.

Retention period: data on your interactions with OVS will be retained for a maximum period of 12 (twelve) months from the date of collection. Purchase data will in all cases be kept for a maximum period of 24 (twenty-four) months after registration (or for any other period established by applicable legislation or orders of the Italian Data Protection Authority).

Purpose of processing: to verify that the person purchasing products from the Website is the holder of the selected payment instrument.

Personal data processed: first name, surname, e-commerce order details and information on the type of payment instrument used to make the purchase.

Legal basis for processing: legitimate interest of OVS in the prevention and combating of fraud

Retention Period: 5 (five) years following the collection of the data, without prejudice to a different storage period for the protection of OVS's legal rights.

Purpose of processing: to enable you to save certain content (e.g. the “Wishlist” – your preferred products list, purchase history, etc.), to enable you to register on the Website by creating a private area (the “account”); (ii) to enable you to purchase products, fulfil obligations and exercise rights arising from a contract, to save some content (e.g. your “Wishlist” of preferred products, purchase history, etc.).; (iii) to fulfil legal, regulatory or Community tax or accounting obligations (invoicing, keeping of records and accounts).

Personal data processed: personal and contact details provided in the online form for registration with the private area. You are absolutely free to decide whether or not to provide your data to us, but if you decide to do so, we ask you to complete the form with all the data indicated as “mandatory” (*) because the data are necessary for your registration. If you do not fill in the form or if it is incomplete, we will not be able to proceed with your registration. Failure to complete the data marked as “optional” will not have any consequences.

Legal basis for processing: 

  • execution of the contract for registration with the Website (Article 6, 1, b of the Regulation).
  • legal obligation (Article 6, 1, c of the Regulation) => we are obliged to process the data necessary for the purpose of fulfilling legal, regulatory, Community, tax or accounting obligations (invoicing, keeping of records and accounts).

Retention period:

  • your account and its related data will be deleted if you do not use your account for more than 5 (five) years.
  • for accounting purposes, personal data will be retained for the period required by law.

Purpose of processing: to make the user experience easier when using your account (private area) by allowing you to stay logged in to your account after the end of your browsing session (in order to view any promotions active on your account, recommended products, access to your Wishlist, etc.).

Personal data processed: your access credentials to the private area.

Legal basis for processing: your consent, which is expressed by your acceptance of a cookie (see also our cookie-policy).

Retention period: The cookie that allows you to save your access credentials will remain active for a period of 3 months.
You can deactivate cookies at any time by accessing the Cookie Settings section Cookie Settings in the Cookie Policy document.

To enable us to achieve the purposes listed above, we may disclose your data:
- to OVS personnel in the context of their professional duties
- to suppliers of OVS (for example (i) companies and consultants that provide digital filing, preservation and processing services on our behalf, and other IT platform and service providers, (ii) companies that provide services for the enveloping and/or dispatch or mailing of promotions and advertising, or that perform promotional activities (data limited to name, surname and address for general mailings; email address for electronic mailings; and phone number/mobile number for telemarketing activities) (iii) companies engaged to manage warehouse logistics and the dispatch of purchased products, (iv) our affiliates that manage the stores, in connection with the loyalty programme (e.g. "PIOMBO CLUB"); (v) any companies responsible for customer care on behalf of OVS): such entities operate in the capacity of external Data Processors pursuant to Article 28 of the Regulation;
- Credit institutions (for the handling of payment for your purchases): these entities act as autonomous data controllers and their involvement is necessary for operations related to the use of our services (e.g. making payments).

OVS uses cookies in some areas of the Website. Cookies are usually strings of text that websites (“publishers” or “first parties”) visited by the user or different websites or web servers (so-called 'third parties') place and store within a terminal device available to the user. We invite you to read our cookie-policy, which should be consulted in conjunction with this policy.

On the Website you may also find some social network icons (for example, Google, Facebook, Amazon etc.) that allow a user browsing the Website to interact directly with the social network with a click that enables the social network to obtain data on the visit. In some areas of the Website, there is also a "social login" (i.e. authentication via social network), that enables a user to access their private area through the relevant social network account. Note that when you login to the social network, you accept the terms and conditions of use and the privacy policy of the social network itself.

Personal data that is collected may be transferred outside of the European Union. In this case, the transfer will take place in accordance with the provisions of Regulation (EU) 2016/679 (the “GDPR”) (in particular, the data will only be transferred after signing the Standard Contractual Clauses approved by the EU Commission by decision No. 2021/914/EU or to countries that can guarantee an adequate level of protection of personal data, i.e. those that have been the subject of an Adequacy Decision by the EU Commission).

Some personal data collected may be transferred abroad to locations outside the European Union. Such transfers will, however, be made in compliance with the guarantees prescribed by the GDPR for this type of activity (Articles 45 to 49). These include: transfer to companies located in countries for which the existence of personal data protection guarantees comparable to those of the GDPR is recognised and which have therefore been the subject of an Adequacy Decision adopted by the EU Commission (White List countries); or to companies with which specific personal data protection contractual clauses, approved by the Data Protection Authority, or binding corporate rules approved by the Data Protection Authority have been signed, or in which the transfer is made on the basis of specific derogations. For further information, contact the Data Controller as indicated in the point below entitled "The rights you can exercise, the option of making a complaint and contact details".
 

OVS S.p.A. has appointed a Data Protection Officer (DPO), who is responsible for supervising compliance with personal data protection legislation and who acts as the point of contact for requests from persons to whom the personal data relate.
If you wish to contact our Data Protection Officer (DPO), you can do so at the email address responsabileprotezionedati@ovs.it, or by telephone at number +39 041 239 7500.

in accordance with current legislation (Articles 15 to 22 of the Regulation) you have the right to access your data (Article 15), their rectification or supplementing (Article 16), their deletion (the so-called right to be forgotten, Article 17), the restriction of their processing (Article 18) the right to portability of your data (Article 20), the right to object to the processing of your data for particular reasons (Article 21) and not to be subject to an automated decision-making process (Article 22). You are also reminded that you are always entitled to make a complaint to the Italian Data Protection Authority (www.garanteprivacy.it). 
 

To exercise these rights, users may (i) write using the contact form available on the Website, (ii) send an email to hello@piombo.com, or (iii) write to OVS S.p.A., Via Terraglio No. 17, 30174, Mestre (VE), for the attention of the Data Protection Officer (DPO).


You are reminded that you also have the right:
(i)to withdraw at any time your consent to contacts for the purposes of advertising/promotional communications. In this case you will no longer receive any type of electronic or paper communication. If you wish, you may withdraw your consent solely for the receipt of communications via social networks and other digital channels, email, text messages, MMS, etc., while continuing to receive commercial communications only by mail or telephone contact with an operator, where provided.
(ii)to withdraw consent at any time for the performance of profiling activities.

We reserve the right to update the content of this page from time to time. Consult this policy statement regularly to keep up to date with any changes after your last consultation.


Last Updated: 10 October 2023