Privacy policy pursuant to Regulation (EU) 2016/679 (GDPR) and the national legislation in force in Italy (Legislative Decree 196/03)


1. General Information
G & P Cosmetics s.r.l. (hereinafter also referred to as the “Company”) hereby informs you (please note that you are hereinafter also referred to as the “User”), that for the purposes indicated below, it will process your personal data (or those of the Company you represent if acting on its behalf), which you provided. Only the data necessary for the pursuit of the purposes indicated in this privacy policy shall be requested and processed. Please note that you must only provide your data and/or data of the Company represented by you. If you are acting on behalf of a Company, the activities envisaged in this privacy policy shall be carried out in relation to the Company using the data you have provided and therefore consenting to the processing (where consent is required) on behalf of the Company you represent.

2. Purposes and legal basis
The Company will be processing your data:

A. in order to, with your consent, be able to address your request for information and do everything necessary to fulfil your request; the legal basis of the data processing is consent.
B. in order to fulfil an obligation imposed by law, regulation or EU legislation; the legal basis is fulfilling a legal obligation;
C. for legitimate interests such as to assert or defend a right of the Company; the legal basis of the data processing is the pursuit of legitimate interests.
D. so that the Company may send you advertising messages and/or information on the Company’s products/services/initiatives and those of its partners to the e-mail address you indicated in the form (please note that e-mails may also be sent through automated tools). Data processing is based on the following legal basis: consent;

3. Compulsory provision of data
The provision of data for the purposes referred to in point 2, letter A of the privacy policy is optional, however failure to provide such data will make it impossible to address your request. Consent to the processing of data for the purposes referred to in point 2, letter A of this privacy policy is optional and failure to give consent (which can always be revoked freely and without justification by contacting the Company) will, however, result either in the impossibility of responding to the request or the provision of data necessary for the purposes set forth in point 2 letters  B and C of this privacy policy is necessary and failure to provide such data will make it impossible to process the data and therefore to respond to the request.
You may or may not disclose your personal data/that of the Company you represent to us for the purposes set forth in point 2 (D) of the privacy policy, just as you may or may not provide your consent. Failure to provide consent will therefore have no consequences other than not being subject to the activities referred to in this point on the part of the Company (thus there being no consequence on the other purposes) or not being subject to such activities to the specific addresses you do not wish to provide to us. Furthermore, should you consent to the processing of your personal data for the purposes set forth in point 2 (D) of this privacy policy, you may always revoke your consent freely and without any reasons (and thus object to the activities in question) by contacting the Company.

4. Categories of data recipients
For the purposes referred to in point 2 (A) and 2 (B) above, the data shall not be disclosed to third parties. For the purposes referred to in point 2 (B) of this privacy policy, the data may be disclosed, only if necessary, to public bodies, judicial bodies and police forces.
For the purposes referred to in point 2 (C) of this privacy policy, the data may be communicated, only if necessary, to lawyers/legal consultants, public bodies, judicial and police organs and to the post office (they may see the address for sending any written communications).
The Company shall only disclose data that are indispensable for the pursuit of the individual purposes set out in this privacy policy.  
The Company may then appoint (and, thereby disclose the data to) all those specifically delegated to data processing to process the data on its behalf, each one only processing indispensable data (employees of the sector to which the request is addressed, employees in charge of managing the site, also external to the Company, consultants, also external to the Company - e.g,. legal consultants, computer technicians, employees of information systems, also external to the Company, employees in charge of relations with the public, also external to the Company). The Company has also identified Data Processors (also appointed by the Company) who may only have access to the data required to carry out the tasks assigned to them (such as IT outsourcing and site management companies, parent companies, call centers and, more generally, companies or firms that carry out activities that are instrumental to those of the Company such as, for example, consulting companies or firms). The list of such data processors can be obtained by contacting the Company using the contact details provided in point 6 of the privacy policy.

5. Data retention
Your data may be stored and processed by the Company for as long as required for pursuing the purposes set out herein. The retention period is as follows:
- for the purpose of complying with legal obligations, regulations and EU legislation, for so long as provided for by such legislation;
- for the purposes referred to in point 2 (A) of this privacy policy, the data may be kept until the request for information has been fulfilled;
- for the purposes set out in point 2 (D) of this privacy policy, until consent is withdrawn or a request for erasure is submitted, without prejudice to retention for evidential purposes for the period provided by the law;
- in any case, all data may be retained for a period necessary to enforce or defend a right of the Company under Italian and European law.

6. Data Controller and Data Protection Officer
The Data Controller is: G&P COSMETICS SRL, having its registered office in Via L. Mascheroni No. 27 - 20145 Milano (MI-Italy), Tax Code, VAT number and Padua Company Register No. 04778640963, E.A.I. No. MI 1771789, Share  Capital EUR 62,500.00 fully paid-in, a company subject to the management and coordination of AGF88 Holding S.r.l., Tel.  0575 720 682, FAX 0575 749 923, gruppoprivacy@agf88holding.it.
As of today, the Company is not legally required to have an internal Data Protection Officer. In case such a function should become necessary, the identity of the relevant person will be made known through the Company’s website https://www.pettenon.it/it, which you are encouraged to visit periodically, including for any updates to this privacy policy.

7.  Rights
We hereby inform you that the GDPR allows the data subject to request to the Company (using the contact details provided above) full access to its personal data and the rectification of such data, the data erasure, a restriction to the data processing, and the right to data portability; the data subject may also object to the processing of its data, again by contacting the Company, and exercise the other rights set forth in Chapter 3, Section 1 of the GDPR, including that of revoking consent, where envisaged: revocation of consent shall not however affect the lawfulness of the processing based on the consent given before revocation.

8. Complaints
If the User believes that the processing of his or her personal data violates the provisions of the GDPR and privacy regulations, he or she may always lodge a complaint with the Italian Data Protection Authority, whose details can be found at www.garanteprivacy.it.

9.  Processing procedures
We hereby inform you that the data will be processed on the basis of computerised and paper/manual instruments, and that suitable protection systems will be adopted to safeguard confidentiality. All data shall be stored and processed in a manner that will fully protect confidentiality in compliance with all the regulations in force (and therefore also in accordance with the principles of fairness, lawfulness and transparency and protection of confidentiality and rights) and strictly in the pursuit of the purposes set out in this privacy policy. Only the operations necessary to pursue the purposes set out in this privacy policy shall be carried out on the data. The data shall be stored, as far as the Company is concerned, at its headquarters or server farm and as far as the data processors are concerned, at their headquarters or server farms. Any data disclosed to third parties will be stored and processed by them independently. The data will also be arranged in databases, including computerised databases.

Privacy policy updated as of 25/08/2022
The above information is available by writing to the Company at the addresses listed above.