Privacy policy
1. Subject
The website https://www.theploumanach.com (hereinafter referred to as “the Website”) is operated by Kostner S.r.l., with its operational office at Salita S.Bambino 8 - 16011 Arenzano (Ge), Italy; e-mail: info@theploumanach.com; phone: +390109131349, acting as the Data Controller (hereinafter referred to as “Kostner”). The security and privacy measures applicable to this website have been defined and developed to ensure that personal information is properly handled in compliance with local and international security and privacy regulations, in accordance with Article 5 of the General Data Protection Regulation (hereinafter “GDPR”).
Before providing any personal data, we invite you to carefully read this Privacy Policy (hereinafter referred to as "the Policy" or "Privacy Policy"), as it contains important information regarding the protection of personal data and the security measures implemented to ensure its confidentiality in full compliance with the GDPR.
This Policy outlines how personal information of users (hereinafter “user,” “users,” or “you”) is processed by Kostner, in accordance with Article 13 of the GDPR, and explains how such personal information is used, shared, accessed, modified, or deleted. As a testament to its commitment to privacy, Kostner has established this Policy within the broader framework of a global privacy management model, ensuring that privacy is upheld as a core element of Kostner's corporate culture. All personal information provided by users through this Website is used exclusively for the purposes described below.
This Policy also:
applies solely to the website https://www.theploumanach.com and does not extend to other websites that may be accessed via external links.
2. Source and Types of Personal Information
Kostner processes different types of user information, collected from various sources, including:
- information provided directly by the user;
- information obtained through automatic tracking systems during the use of the Website and its related services.
More specifically, Kostner may process the following personal identification data of the user:
a) Information provided by the user when writing a review, submitting a contact request, during the registration process, and/or at the time of completing an order (e.g., first and last name, address, email; phone number, password; gender; city, state; address, tax code, VAT number, delivery phone numbers, and other information included in the correspondence or requests sent by the user to Kostner). Kostner may also request the user to provide certain information in the event of reporting issues with Kostner's services on the Website;
b) Information related to the user's use of the Website. For security purposes, Kostner processes browsing data (log files) related to each session when the user accesses their account, as well as payment information, which will be processed exclusively through the service provider chosen by Kostner;
c) Information related to the user's social network profile, if public.
Kostner manages "Fan" pages available on various social networks (e.g., Facebook, X, Instagram, Pinterest, TikTok, etc.). We may need to process information made available by these platforms or when you interact with our pages and posts.
When a user decides to interact with our social media pages (for example, when following one of our pages, clicking "Like" on Facebook, "Follow" on Instagram, reacting to a post, "sharing" or adding a "comment," etc.), we gain access to the user's public profile information. This information is used to interact with the user through the respective social network or to conduct analyses or statistics on the use of our pages or the performance of our communications. Our services may remove user comments if they do not comply with our social media usage policies (for example, if the comments are offensive, illegal, or harmful).
When the user visits our "Fan" page without having an account or being logged into the respective social network, we do not collect any personal information about them, except for aggregated data provided by each social network.
Since the installation of third-party cookies through the services used on the Website cannot be controlled by the Data Controller, any specific reference to cookies and tracking systems installed by third parties is to be considered indicative.
d) Browsing information. When users browse the Website, Kostner uses certain technologies (cookies, see below for more information) that automatically collect certain information about how users utilize Kostner's products and services, such as the IP address or another unique identifier of the device (computer, mobile phone, or other device) used by the user to browse the Website, user identification, even if not registered, and technical information that may include the referring URL, and browser information. This information allows Kostner to continuously improve the browsing experience and the purchasing mechanism for its products and services, as well as monitor the proper functioning of the Website. This information consists solely of statistical data about the activities performed by the user and is not intended to be associated with the user's personal identification data. However, browsing data could potentially allow user identification only if combined with the user's personal identification data;
All of the aforementioned identification data are hereinafter collectively referred to as “information.”
3. Purpose of Processing
3.1 Contractual Purposes
The information collected by Kostner is used for the following purposes:
- to allow users to register on the Website;
- to provide the services available through the Website (e.g., providing information, writing a product review, managing the registration process, and accessing the account, account management);
- to manage online purchases/orders, process and fulfill orders, ship and deliver products purchased by the user;
- for the technical management of the Website and its operational functions (including logistics), including resolving any technical issues, statistical analysis, testing, and research;
- to fulfill user requests (e.g., handling information requests).
The legal basis for processing Personal Data for the purposes mentioned above is the provision of a service or the response to a request, which does not require consent under the GDPR (performance of a contract or pre-contractual measures).
3.2 Marketing Purposes (Commercial Communications)
The information collected by Kostner is used for the following marketing purposes with the prior consent of users in accordance with Article 7 of the GDPR:
a. to send commercial and promotional communications, as well as periodic updates (via email, SMS, instant messaging applications, traditional mail, phone calls) related to Kostner's products;
Please note that you can revoke your consent at any time.
Revocation of consent does not affect the lawfulness of processing based on consent prior to revocation.
3.3 Profiling Purposes
The information collected by Kostner is used for profiling purposes with the prior consent of users in accordance with Article 7 of the GDPR:
a. to personalize marketing/newsletter activities (via email, SMS, instant messaging applications, traditional mail, phone calls) based on your previous purchases, personal preferences, and interests.
Please note that you can revoke your consent at any time.
Revocation of consent does not affect the lawfulness of processing based on consent prior to revocation.
4. Data Processing Methods
Data processing is carried out through the operations specified in Article 4, point 2) of the GDPR, specifically: collection, registration, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, deletion, and destruction of data. Users' data are processed with the aid of electronic tools through the Website and the servers on which it is hosted, and without the aid of automated processes (e.g., profiling).
Data will not be disseminated.
5. Categories of Individuals Who May Access the Data
Any personal information provided or collected through the Website will be processed by Kostner as the Data Controller. Personal information will be processed by Kostner's staff responsible for handling the collected personal data:
-
- employees and consultants authorized to manage the Website and provide related services (e.g., customer service, management of Kostner's computer systems, etc.), acting as authorized/designated data processors and/or system administrators;
- employees and consultants from Kostner’s marketing, finance, administration, accounting, and other departments, acting as authorized/designated data processors.
Kostner may also request its service providers to carry out certain data processing operations on its behalf, in accordance with the instructions provided by Kostner and in line with this Privacy Policy. These providers will process personal information as Data Processors based on appropriate contractual commitments, or as independent Data Controllers. These providers include, but are not limited to:
6. Third Parties to Whom Information May Be Disclosed
User information may also be disclosed to third parties for the following reasons:
a. to comply with obligations established by laws, regulations, protocols, and national or European legislation;
b. to enforce rules required by public authorities;
c. to allow Kostner to defend itself in legal proceedings, for example in cases of network violations by users.
The mentioned parties will process the information as independent Data Controllers. Therefore, the use of the data by these third parties will not be governed by this Privacy Policy.
7. Data Transfer Outside the EU
Personal data will not be transferred to recipients outside the European Economic Area. Should this occur in the future, Kostner ensures that the processing of Personal Data will be carried out in compliance with the GDPR. In fact, transfers will be based alternatively on an adequacy decision or on the Standard Contractual Clauses approved by the European Commission. More information and copies of these agreements will be available from Kostner.
8. Nature of Providing Personal Information and Consequences of Refusal
Providing information for contractual purposes as stated in point 3.1 is mandatory as the data is necessary for the performance of a contract or pre-contractual measures requested by the user. In the event of failure to provide the data, Kostner will not be able to proceed with the request.
Providing information for marketing purposes (point 3.2) and profiling purposes (point 3.3) is voluntary and optional. Users may freely choose not to provide information for marketing and/or profiling purposes, and may subsequently withdraw their consent to the processing of information already provided: in such cases, users will not receive Kostner’s commercial communications as described in point 3.2 and point 3.3, but will continue to use the services mentioned in point 3.1 of this Privacy Policy.
9. Security
Kostner employs appropriate security measures to protect information from unauthorized access or alteration, as well as from the unauthorized transmission or distribution of data. In order to prevent unauthorized access, maintain data accuracy, and ensure the proper use of information, Kostner uses adequate physical, electronic, and managerial procedures to safeguard and protect the information and data stored within its system.
The site is protected by the HTTPS protocol, which ensures the integrity and confidentiality of the data exchanged between computers and websites. Data sent via HTTPS is secured through the Transport Layer Security (TLS) protocol, which provides three essential levels of protection:
- Encryption. The data exchanged is encrypted to protect it from interception. This means that, while users browse a website, no one can "eavesdrop" on their conversations, track their activities across multiple pages, or capture their information.
- Data Integrity. The data cannot be altered or corrupted during transmission, whether intentionally or accidentally, without detection.
- Authentication. It ensures that users are communicating with the intended website, protecting against man-in-the-middle attacks and fostering user trust, which translates into additional business benefits.
Kostner is committed to safeguarding user information. Kostner informs users that their password is one of the mechanisms for protecting their account; therefore, users are encouraged to use a sufficiently secure password and store it in a safe place, limiting account access to their own computers and browsers, and logging out after visiting the site. Kostner is dedicated to protecting the information received from users. All personal information provided is stored on secure servers.
Information regarding purchase transactions is securely handled by service providers (PayPal and Shopify), who, as independent Data Controllers, guarantee the implementation of appropriate security measures. Kostner will not have access to any information related to the user's credit card (e.g., card number) used to make the payment, as the payment will occur directly through the website of the user's preferred online payment service provider.
Information about the data processing by the independent Data Controllers can be found at the following links:
https://help.shopify.com/it/manual/privacy-and-security/privacy (Shopify).
https://www.paypalobjects.com/marketing/ua/pdf/IT/it/privacy-full.pdf (PayPal)
10. Storage and Deletion of Information
Kostner accesses, uses, processes, archives, and stores the personal information collected exclusively for the purposes indicated in this Privacy Policy and in accordance with the user's expressed consent, where necessary. In particular, Kostner collects personal information in line with:
- the purposes for which it was collected;
- the consent received from the user;
- national and international regulations.
Personal information is stored and deleted in accordance with Kostner’s security policy for the duration necessary to achieve the purposes for which the data was collected and subsequently processed, including the data retention periods required by law (e.g., retention of accounting records). As a guideline, Kostner retains order information for 10 years for tax and accounting purposes. This information includes name, email address, and billing and shipping addresses; until consent is revoked for marketing purposes (newsletter - sending commercial communications) and for profiling activities (but for a maximum of 12 months from the date of data registration).
The user can revoke their consent at any time by contacting the Data Controller (Kostner) using the contact details provided in this policy (see point 14 below) or simply by unsubscribing from the Kostner newsletter by clicking on the "Unsubscribe" link found in every email received.
More information regarding the personal data retention period and the criteria used to determine such a period can be requested by contacting Kostner at the contact details provided below.
11. Use of Cookies
Kostner collects Personal Data through cookies. More information on the use of cookies and similar technologies is available by clicking the following link:
https://www.theploumanach.com/it/pages/cookie-policy
12. Data of Underage Users
The Website is not intended for individuals under the age of 18, and Kostner does not knowingly collect personal information from them.
In the event that any information about minors is accidentally registered, Kostner will promptly delete it upon request from the users.
13. Data Subject Rights in Relation to Personal Information
Users have the right to obtain confirmation from Kostner regarding the existence of personal data concerning them, access to it, and communication in an intelligible form; users can also request to know the origin of the data, the purposes, and methods of processing. Additionally, users can obtain the updating, correction, or integration of the data. Users can also always revoke their consent, request the cessation of processing, deletion, anonymization, or blocking of processed information. Users may object, in whole or in part, to the processing: a) for legitimate reasons, to the processing of their personal data; b) for the purpose of sending advertising material, conducting market research, or for commercial communications and/or for profiling purposes. Users are also entitled to the rights set out in Articles 16-21 of the GDPR (right to rectification, right to erasure, right to restriction of processing, right to data portability, and right to object).
Users who believe that the processing of their personal data through this site is in violation of the provisions of the Regulation have the right to lodge a complaint with the Data Protection Authority, as provided by Article 77 of the Regulation, or to take legal action (Article 79 of the Regulation).
Kostner also provides users with tools to update and modify the personal information they have provided. Each registered user can access their personal information and update it (e.g., through the user’s account). Users can also modify and update their preferences regarding how they wish to receive emails or other communications from Kostner. Users can also request the deletion of their account information.
You can exercise the above rights at any time by contacting Kostner at the contact details provided in point 14 of this policy.
14. Contact Information
The Data Controller for users' data is Kostner, with its registered office at Via della Pineta 2A - 16011 Arenzano (Ge), phone: +390109131349. The updated list of Data Processors and individuals responsible for processing is available at the Data Controller's office. For any requests (e.g., exercising data subject rights – see point 13 of this policy) or comments regarding this Privacy Policy, Kostner can be contacted at the following email address: info@theploumanach.com.
15. Changes to the Privacy Policy
For legal and/or organizational reasons, this Privacy Policy may be subject to changes; therefore, we recommend regularly checking this Privacy Policy and consulting the latest version published on the website.