The Data Controller delegates, under its own responsibility, certain processing operations and the management of certain purposes to external parties. In these cases, the relationship with the third party is governed by a specific "Data Processor" contract pursuant to Art. 28 of the GDPR.

As required by the Transparency Guidelines WP 260/2017, if the Data Controller chooses to indicate the data processors and, more generally, the data recipients by category, he must justify why he believes this approach is correct. In any case, the reference to the category must not be generic but specific, referring to the activities carried out, the sector, the industry, and the territorial location of the recipients identified by category.

From this perspective, the Data Controller believes that the approach based on categories of recipients of the communication is correct in this case, since the indication of the names of suppliers and subcontractors would be excessive and liable to obsolescence.

Request information about items, add items to your cart, select items from your favorites.

• Data categories processed: identifiers, cart/purchase data.
• Legal basis: pre-contractual measures.
• Duration of processing and retention period: six months from collection or, if earlier, until the transaction is completed, without prejudice to the retention of data relating to the transaction.
• Nature of the provision: necessary (failure to provide it will prevent the related activity from being carried out).

This purpose includes the data processing required to create an account on the website www.mobilirebecca.it to manage your preferences and purchases made or to be made. You can also sign up for the reserved area using your Google account.

• Data categories processed: identifiers, contact details, shopping cart/purchase data, payment data.
• Legal basis: contract/pre-contractual measures.
• Duration of processing and retention period: until the account is deleted.
• Nature of the provision: necessary (failure to provide it will prevent the related activity from being carried out).

This purpose includes the data processing necessary for the management, completion and execution of the sales contract between the Customer and the Data Controller, including the purchase procedure (inserting items in the cart, selecting the payment method, invoicing, chatting with customer support, entering identification and delivery data, etc.) and all activities necessary for the execution of the sale of the products and related to them (post-sales, customer care, etc.).

• Data categories processed: various types of identification data, contact data, cart/purchase data, payment data, browsing data.
• Legal basis: contract.
• Duration of processing and retention period: for the entire duration of the contractual relationship and for the following 10 years (order history).
• Nature of the provision: necessary (failure to provide it will prevent the related activity from being carried out).

Processing related to the fulfillment of administrative, fiscal, and legal obligations (management of invoicing and payments, withholdings, tax obligations, financial statements).

• Categories of data processed: identification, contact, payment, purchase-related.
• Legal basis: legal obligation.
• Retention period: until the expiration of the legal deadlines for compliance, including late compliance (e.g., until the expiration of the deadline for any late disclosures and declarations), generally no longer than ten years. The data is then retained for the duration of legal obligations related to the preservation of proof of such compliance.
• Nature of the provision: necessary (failure to provide it will prevent the related activity from being carried out).

Retention of records and documents where legally required, e.g., retention of accounting records to fulfill civil obligations (Articles 2214 and 2220 of the Italian Civil Code) and to fulfill tax control powers (e.g., II. DD. Article 43 of Presidential Decree 600/73, for VAT Article 57 of Presidential Decree 633/72, Article 76 of Presidential Decree No. 131/86 for registration tax, Article 17 of Legislative Decree 347/90 for mortgage and land registry taxes, Article 1, paragraph 161 of Law 296/06 for local taxes, etc.).

• Categories of Data Processed: All data collected for other purposes.
• Legal basis: legal obligation.
• Retention period: ten years from the last recording (for accounting records) or from the date of the document.
• Nature of the provision: necessary (failure to provide it will prevent the related activity from being carried out).

Processing related to fulfilling data protection obligations (e.g., responding to requests to exercise data subjects' rights).

• Categories of Data Processed: All data collected for other purposes.
• Legal basis: legal obligation.
• Retention period: ten years from the last data recording.
• Nature of the provision: necessary (failure to provide it will prevent the related activity from being carried out).

Processing related to technical support and monitoring of the Company's IT infrastructure, in order to maintain its integrity and system protection. During these activities, individuals performing support activities may come into contact, even through mere viewing, with data relating to interested parties such as the Customer.

• Categories of Data Processed: All data collected for other purposes.
• Legal basis: legitimate interest. The Data Controller's interest in being able to perform interventions on its systems, even if they involve data processing, must prevail over the interest in confidentiality and data minimization, where such interventions are deemed necessary for the security of the systems, the company's assets, and, ultimately, the data subjects' data.
• Retention period: duration of the intervention.

Processing related to the purpose of taking action or resisting, both in extrajudicial proceedings (including conciliation) and in court, in disputes that may arise with the Customer or with third parties.

• Categories of Data Processed: All data collected for other purposes.
• Legal basis: legitimate interest. The Data Controller's right to defense, guaranteed by the Constitution, must prevail over the user's right to privacy, especially given the security measures the Data Controller adopts and which allow processing in accordance with the principles set forth in Article 5 of the GDPR.
• Retention period: ten years from the last activity related to the contract, coinciding with the ordinary limitation period, unless the law provides for shorter periods of action, limitation, or forfeiture (art. 112, paragraph 5 of Presidential Decree 1124/55, arts. 2946, 2947, 2948 of the Civil Code, art. 3, paragraphs 9 and 10 of Law 335/95).

With your optional consent, which can be expressed by selecting the appropriate consent box in the dedicated sections of the Website (opt-in), including the "Subscribe to our newsletter" section, we will process your data for marketing purposes (sending, via the chosen communication channels, advertising material, offers, promotions, discounts, etc.). In relation to promotional communications sent by email, you may withdraw your consent to the processing of your email address for marketing purposes (newsletter, etc.) at any time, including by clicking the unsubscribe link (opt-out) in each promotional email.

• Categories of data processed: identification data, contact data.
• Legal basis: consent.
• Retention period: until consent is revoked, which will in any case be requested again after 24 months and, subsequently, for 10 years in order to demonstrate compliance with personal data protection obligations.
• Nature of provision: optional. Failure to provide consent will not affect contractual performance.

As provided for by the WP259 Guidelines on consent and Recital 32 of the Regulation, a single consent can be applied to all processing activities carried out for the same purpose or purposes. The purposes specifically indicated above can objectively be traced back to the pursuit of a single purpose, despite the different processing operations, which is commercial promotion and marketing in the broadest sense. Consequently, by providing a single consent to Processing for Marketing Purposes, the interested party specifically acknowledges the homogeneous and different promotional, commercial, and marketing purposes specified above (including the resulting management and administrative activities) and expressly authorizes said processing and purposes, whether the means used are telephone with an operator or other non-electronic, non-telematic means or not supported by automatic, electronic, or telematic mechanisms and/or procedures, or whether the means used are email, fax, SMS, MMS, automatic systems without operator intervention, and similar, including electronic platforms and other telematic means.

The definition of Processing for Marketing Purposes includes both the processing and purposes specified above pursued by the Data Controller during the term of the contractual relationship, as well as those specific ones following the termination of the Contract, for whatever reason, and aimed at sending the interested party unsolicited communications to invite them to renew the contract by each of the means indicated above.

Pursuant to the General Provision of the Italian Data Protection Authority dated 15 May 2013 ("Consent to the processing of personal data for direct marketing purposes through traditional and automated contact tools"), the Customer's attention is drawn to the fact that: (i) consent given for sending via automated tools will imply receipt also via traditional methods (postal mail or operator-assisted phone calls); (ii) the right to object will also extend to traditional methods, without prejudice to the possibility of exercising it in part.

For the purposes of fulfilling privacy obligations in accordance with the principles of simplification, the Data Controller informs that the specific consent form will be uniform and comprehensive and will refer to all possible means of marketing processing, without prejudice to the possibility for the data subject to express a different wish regarding the use of certain means and not others for receiving marketing communications, subject to consent, by sending an email to the addresses indicated in Article 14 of this policy.

Furthermore, the specific consent form will be uniform and comprehensive and will also refer to all the different and possible marketing purposes explained herein, without prejudice to the possibility for the interested party to notify a different selective will regarding consent/denial/revocation for individual marketing purposes by sending an email to the addresses indicated in this notice

Through this page you can contact the Data Controller either via WhatsApp messaging or via an HTML form where you can enter your details and the reason for your request, in order to request information and assistance on purchases, or make complaints.

• Categories of data processed : identification data, contact data, data relating to purchases
• legal basis: contract / pre-contractual measures
• Retention period : six months.
• Nature of provision : Necessary. Providing the data is necessary to provide the service.

For remarketing and service improvement purposes, the Data Controller intends to process so-called "profiling" data through its website. This occurs primarily through the use of activity tracking tools on the website www.mobilirebecca.it, such as profiling cookies and its own or third-party pixels, such as Meta Pixel, which allows the use of Facebook services such as Facebook Custom Audiences, Facebook Lookalike, and Facebook Remarketing. For further information, please refer to the specific information on cookies and similar technologies.

• Categories of data processed : identification data, contact data, data relating to purchases
• legal basis: consent
• Retention period : twelve months.
• Nature of provision : optional. Providing the data is not necessary to provide the service.

Here, we briefly remind you that with the help of this service, we can target our customers (always with their specific and separate consent) by activating (for example, via Facebook) so-called Facebook Ads for visitors to our websites or Google Analytics. To this end, we have implemented Facebook remarketing pixels on our websites. These are code snippets that can identify your browser type using your browser ID, or your browser's "fingerprint," and recognize whether you have visited our websites and what exactly you viewed. When you visit our websites, the pixel establishes a direct connection to Facebook's servers. Facebook can identify you based on your browser ID, as it is linked to other data stored by Facebook and your user account. Facebook then provides you with personalized, needs-based ads in your Facebook timeline or elsewhere on Facebook. The Data Controller itself is not able to personally identify you via the Facebook pixel, as no other personal data, other than your browser ID, will be stored by us via the Facebook remarketing pixel.

Further information about Facebook Custom Audiences, details on data processing by this service, and Facebook's privacy policy can be found at https://www.facebook.com/about/privacy/ .

In general, for such processing, and for the purposes of complete information, reference is made to the definition in art. 4, paragraph 1, no. (4) of the GDPR, which defines "profiling" as "any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements".

Pursuant to the WP 251 Profiling Guidelines of 3 October 2017, as issued by the European Data Protection Authority (EDPA), we provide transparent information on the logic, methods, and mechanisms of profiling, and clarify below and separately the cases in which the Data Controller may make decisions based on fully automated processing.

Profiling may involve "individual" personal data or "aggregated" personal data derived from detailed individual personal data. To clarify what "profiling" consists of, the following parameters can be considered as examples:

• the data is structured and coordinated based on predefined parameters identified from time to time, depending on the company's needs (regardless of marketing, contractual, administrative purposes, etc.);
• The initial data, considered individually, may include a variety of personal information, including data on browsing experiences, types of consent given to receive specific commercial communications and not others, data on browsing and/or gaming habits to reconstruct the user's tastes and habits, identifying their profile as a potential consumer/gamer, in order to send them newsletters, commercial communications, offers and promotions consistent with the identified profile, etc.;
• Only following profiling (i.e., structuring according to pre-established parameters) is it possible to deduce further information relating to each interested party, further information (i.e., the "profile", for example, market segment, active marketing communications services, commercial aptitude, etc.) that would not derive from the mere informative aptitude of the data considered individually or separately.

In other words, profiling in the strict sense can result in the availability of a wealth of information that goes well beyond the information considered individually and relating to each data subject; furthermore, profiling in the strict sense provides added value given the multiple correlations that can be established between the individual data collected, in order to derive additional useful information.

Regarding the Data Controller's obligations to provide—pursuant to Article 13, paragraph 2, letter f) of the GDPR—information on the logic behind profiling processing, as well as the significance and consequences of such processing, the following is further clarified. The fundamental elements of profiling processing will be:

• 1) the predetermination of the parameters for the structuring of the data considered individually;
• 2) the comparison, cross-referencing, correlation of such data with each other and the comparative analysis carried out on the basis of predefined parameters, also through automated processes (i.e. the cataloguing of individual data into clusters);
• 3) obtaining a profile through the preceding activities and which allows for the identification of a consumer profile and additional analytical indications with respect to individual data and allows for the generation of mapping/segmentation into homogeneous behavioral groups (dynamic creation of behavioral profiles).

The Data Controller may proceed with the following Profiling Processes, such as in the case of detection of:

• number and type of requests for information on products and services offered made within a predetermined time frame;
• number and type of expenses incurred for products and/or services within a predetermined time horizon;
• number and type of new contracts possibly signed within a predetermined time horizon;
• number and type of information requests sent within a predetermined time frame;
• number and type of visits to the Website within a predetermined time frame, including through profiling cookies.

To proceed with Profiling Processing, it is mandatory to obtain specific, separate, express, documented, prior, and entirely optional consent.

Consequently, where the interested party decides to provide specific consent, they must be informed in advance and aware that the purposes of the processing pursued are of a specific commercial, advertising, promotional, and marketing nature in the broad sense based on Profiling Processing.

In any case, even if the data subject has given consent to authorize the Data Controller to pursue all the purposes of Processing for Profiling Purposes, they will still be free to withdraw their consent at any time, through the Data Controller's website www.mobilirebecca.it, by logging into their personal area with their credentials or, if they do not have a personal profile, by accessing the "Manage cookies" section. We specifically and separately inform you, as required by Art. 21 of the GDPR, that the data subject has the right to object at any time to the processing of their personal data for profiling purposes by simply sending an email to privacy@mobilirebecca.it (even if they have previously given their consent). If the data subject objects to profiling processing, their personal data will no longer be processed for these purposes, without prejudice to the lawfulness of the processing carried out until consent is withdrawn.

The Customer is then free to consent to Processing for Profiling Purposes, but not to further consent to disclosure to third parties who wish to process their data for Profiling Purposes. Should the Customer not consent to disclosure of their data to third parties for Processing for Profiling Purposes, the Data Controller will not communicate their data, and the data will be processed solely and exclusively by the Data Controller, where the user has provided separate consent to Processing for Profiling Purposes.

The data subject to Profiling Processing and the related authorized profiles will not be subject to any dissemination.

for this type of processing, please refer to thespecific information on cookies and similar technologies.