Privacy Policy
INFORMATION ON THE PROCESSING OF PERSONAL DATA of users who visit the website or contact the brokerage firm through digital channels (e.g., WhatsApp, email) regarding the protection of personal data pursuant to Article 13 of Regulation (EU) 2016/679.
Introduction
For years, ESTETEAM SRL has considered the protection of the personal data of its current and/or potential customers and users to be of fundamental importance, ensuring that the processing of personal data—whether automated or manual—is carried out in full compliance with the safeguards and rights recognized by Regulation (EU) 2016/679 of the European Parliament and of the Council, dated April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter the “Regulation”), as well as by other applicable regulations regarding the protection of personal data.
The purpose of this Privacy Policy is to describe how the website is managed with regard to the processing of the personal data of users/visitors who access it, in accordance with the Regulation.
We are committed to ensuring the protection and security of each visitor’s personal data during processing, including in relation to internet access from abroad, consistent with the provisions of this Privacy Policy.
Unless otherwise specified or governed by a specific privacy notice provided pursuant to Article 13 of the Regulation, this Privacy Policy shall also be understood as a document intended to provide the information required under Articles 13 and 14 of the Regulation to those who browse the Websites and interact with the data controller through the services offered by those Websites.
Please note that this Privacy Policy applies exclusively to this website and does not apply to any other websites that the user may visit while browsing by clicking on links and/or banners present on the Websites.
This Privacy Policy defines what data is collected and how it is used, disclosed, transferred, and/or stored by the Website.
This website collects certain personal data from its users.
Data Controller
The data controller is:
ESTETEAM SRL
Registered Office
Via Varesina 174
20156 Milan
VAT No.: 12632430158
Milan Chamber of Commerce REA No. 1573635
Phone: 02 36754870
Email: privacy@esteteam.it
Certified email (PEC): pec@pec.esteteam.com
If you have any questions regarding this privacy policy, you can contact us using the information provided below.
Our users may send requests regarding the protection of personal data, privacy, and security to dpo@esteteam.it
Privacy and the GDPR
Here you can find full details on how we handle personal data, our compliance, and our GDPR policies. To make things easier to understand, we’ve briefly summarized what the GDPR is:
What is the GDPR?
The GDPR (or General Data Protection Regulation) is the European Union’s regulation governing the processing of personal data and privacy. With this regulation, the European Commission aims to strengthen and standardize the protection of personal data for European Union citizens and residents, both within and outside the borders of the European Union (EU).
The GDPR officially took effect on May 25, 2018, and all companies must comply.
Although the GDPR is a European regulation that applies to European companies, it must also be complied with by countries that have relationships with European citizens and therefore process their data.
If you have any questions about what exactly the GDPR is, you can find detailed information here. You can also read the Frequently Asked Questions (FAQ) by clicking here (content in English).
If you have questions about how we handle your data, please contact us.
Types of Data Collected
You can visit our website anonymously.
Among the personal data collected by the website, either directly or through third parties, are: Cookies, Usage Data, Email Address, Name, and various other types of data.
Complete details on each type of data collected are provided in the dedicated sections of this privacy policy or through specific notices displayed before the data is collected.
Personal Data may be freely provided by the User or, in the case of Usage Data, collected automatically during the use of the website or the WhatsApp service.
In cases where the website indicates that certain Data is optional, Users are free to refrain from providing such Data, without this having any impact on the availability of the Service or its functionality.
Users who have any doubts about which Data is mandatory are encouraged to contact the Data Controller.
Any use of cookies—or other tracking tools—by the website or by the providers of third-party services used by the website, unless otherwise specified, is intended to provide the Service requested by the User, in addition to the other purposes described in this document and in the Cookie Policy, if available.
The User assumes responsibility for any third-party Personal Data obtained, published, or shared through the website and warrants that they have the right to communicate or disclose such data, thereby releasing the Data Controller from any liability toward third parties.
Methods of Processing
The processing of personal data is carried out primarily using electronic procedures and media for the time strictly necessary, in accordance with Article 5 of the Regulation.
Personal data will be processed by the data controller only to the extent necessary to achieve the primary purpose. In particular, personal data will be processed for a period of time equal to the minimum necessary, as indicated in Recital 39 of the Regulation, that is, until the termination of the existing contractual relationships between the data subject and the Data Controller, subject to any additional retention period that may be required by law, as also provided for in Recital 65 of the Regulation.
The Data Controller processes Users’ Personal Data by adopting appropriate security measures designed to prevent unauthorized access, disclosure, alteration, or destruction of Personal Data.
Processing is carried out using IT and/or telecommunications tools, with organizational procedures and logic strictly related to the stated purposes. In addition to the Data Controller, in some cases, access to the Data may be granted to categories of personnel involved in the organization of the website and the controlling company (administrative, sales, marketing, and legal staff, as well as system administrators) or to external parties (such as third-party technical service providers, postal carriers, hosting providers, IT companies, and communications agencies), who may also be appointed, if necessary, as Data Processors by the Data Controller. An updated list of Data Processors may always be requested from the Data Controller.
Personal data may also be processed by external parties acting as data controllers for the purpose of fulfilling requests for quotes made through this website or via WhatsApp, email, or contact forms, such as, by way of example:
a. Regulatory and supervisory authorities;
b. Insurance companies;
c. Insurance agents/brokers;
d. Other professional insurance intermediaries;
The data may also be processed, on behalf of the Company, by third parties designated as data processors, who are provided with appropriate operational instructions. These parties essentially fall into the following categories:
a. companies that provide email delivery services;
b. companies that provide website maintenance services;
c. companies that provide support in conducting market research.
Types of Data Processed and Purposes of Processing Related to Browsing the Websites
The Site offers informational and, at times, interactive content. While browsing the Site, information about the user may therefore be collected in the following ways:
Browsing Data
The IT systems and software procedures used to operate the Site collect, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols.
This category of data includes: IP addresses, the type of browser used, the operating system, the domain name, and the addresses of websites from which access was made or exited; information on the pages visited by users within the Site; the time of access; the duration of stay on each page; analysis of internal navigation paths; and other parameters related to the user’s operating system and IT environment.
This technical/IT data is collected and used exclusively in an aggregated and non-identifying manner and may be used to determine liability in the event of hypothetical cybercrimes against the website.
Data Provided Voluntarily by the Visitor
This refers to all personal data freely provided by the visitor on the Site, for example, to register and/or access a restricted area, request information about a specific product or service via a form, send an email, or call (via VoIP) a toll-free number to contact customer service directly. The processing of such personal data will be carried out in accordance with all the information contained in the specific privacy notices provided pursuant to Articles 13 and 14 of the Regulation by each data controller within the Mondadori Group at the time the personal data is provided during registration, as requested in the relevant forms.
In some cases, personal data collected by cookies may also be processed for profiling purposes. The processing of such personal data will be conducted in accordance with the provisions set forth in the cookie policy.
Redirects to External Sites
The Websites may use so-called social plug-ins. Social plug-ins are special tools that allow the functionality of social networks to be embedded directly within the Website (e.g., Facebook’s “Share” feature).
All social plug-ins on the Website are marked with the respective logo owned by the social network platform.
When you visit a page on the Website and interact with the plug-in (e.g., by clicking the “Share” button) or decide to leave a comment, the corresponding information is transmitted from your browser directly to the social network platform (in this case, Facebook) and stored there.
For information on the purposes, types, and methods of collection, processing, use, and storage of personal data by the social media platform, as well as on how to exercise your rights, please consult the privacy policy of the respective social media platform.
Links to/from Third-Party Sites
From the Site, you can access other third-party websites via specific links.
In this regard, we cannot be held liable for any processing of personal data by third-party websites or for the management of authentication credentials provided by third parties.
User Rights
As provided for in Article 15 of the Regulation, the data subject may access their personal data, request its rectification and updating if incomplete or incorrect, request its erasure if the collection occurred in violation of a law or regulation, and object to the processing for legitimate and specific reasons.
In particular, the following are all the rights that may be exercised at any time with respect to the data controller and/or joint controllers:
Right of access: the right, pursuant to Article 15(1) of the Regulation, to obtain from the data controller confirmation as to whether or not personal data are being processed and, if so, to obtain access to such personal data and to the following information: a) the purposes of the processing; b) the categories of personal data concerned; c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular if they are recipients in third countries or international organizations; d) where possible, the envisaged period for which the personal data will be stored, or, if that is not possible, the criteria used to determine that period; e) the existence of the data subject’s right to request from the data controller the rectification or erasure of personal data concerning him or her, or the restriction of processing of such data, or to object to their processing; f) the right to lodge a complaint with a supervisory authority; g) where the personal data are not collected from the data subject, any available information regarding their origin; h) the existence of automated decision-making, including profiling as referred to in Article 22, paragraphs 1 and 4, of the Regulation and, at least in such cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. All of this information can be found in the privacy policy, which will always be available in the Privacy section of each website.
Right to Rectification: the right to obtain, pursuant to Article 16 of the Regulation, the rectification of personal data that are inaccurate, taking into account the purposes of the processing; furthermore, it is possible to have incomplete personal data completed, including by providing a supplementary statement.
Right to erasure: the right to obtain, pursuant to Article 17(1) of the Regulation, the erasure of personal data without undue delay; the data controller is obligated to erase your personal data.
In certain cases, as provided for in Article 17(3) of the Regulation, the data controller is entitled to refrain from erasing your personal data if their processing is necessary, for example, to exercise the right to freedom of expression and information, to comply with a legal obligation, for reasons of public interest, for archiving purposes in the public interest, for scientific or historical research, or for statistical purposes, or for the establishment, exercise, or defense of legal claims.
Right to restriction of processing: the right to obtain restriction of processing, pursuant to Article 18 of the Regulation
In the event of restriction of processing, personal data will be processed—except for storage—only with consent or for the establishment, exercise, or defense of a legal claim, or to protect the rights of another natural or legal person, or for reasons of substantial public interest.
Right to data portability: the right to request at any time and receive, in accordance with Article 20(1) of the Regulation, all personal data processed by the data controller and/or joint controllers in a structured, commonly used, and machine-readable format, or to request that such data be transmitted to another data controller without hindrance. In this case, it is the data subject’s responsibility to provide us with the exact details of the new data controller to whom they intend to transfer their personal data, along with written authorization.
Right to object: Pursuant to Article 21(2) of the Regulation and as also reiterated in Recital 70, you may object at any time to the processing of your personal data if such data is processed for direct marketing purposes, including profiling to the extent that it is related to such direct marketing.
Right to lodge a complaint with the supervisory authority: Without prejudice to the right to seek redress through any other administrative or judicial forum, if you believe that the processing of personal data by the data controller and/or joint controllers violates the Regulation and/or applicable law, you may lodge a complaint with the competent Data Protection Authority.
When Personal Data is processed in the public interest, in the exercise of official authority vested in the Data Controller, or to pursue a legitimate interest of the Data Controller, Users have the right to object to the processing for reasons related to their particular situation.
Please note that if users’ data is processed for direct marketing purposes, they may object to the processing without providing any justification. To determine whether the Data Controller processes data for direct marketing purposes, Users may refer to the relevant sections of this document.
To exercise all the rights identified above, simply contact the Data Controller and/or the joint controllers via email. Requests are submitted free of charge and processed by the Data Controller as quickly as possible, and in any case within one month.
Legal Basis for Processing
The Data Controller processes Personal Data relating to the User if one of the following conditions applies:
– The User has provided consent for one or more specific purposes;
Note: In some jurisdictions, the Data Controller may be authorized to process Personal Data without the User’s consent or another of the legal bases specified below, until the User objects (“opt-out”) to such processing. However, this does not apply if the processing of Personal Data is governed by European data protection legislation;
– The processing is necessary for the performance of a contract with the User and/or for the implementation of pre-contractual measures;
– The processing is necessary to comply with a legal obligation to which the Data Controller is subject;
– The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller;
– The processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or by a third party.
– In any case, you may always request that the Data Controller clarify the specific legal basis for each processing activity and, in particular, specify whether the processing is based on law, provided for by a contract, or necessary to enter into a contract.
Location
The Data is processed at the Data Controller’s operational facilities and at any other location where the parties involved in the processing are located. For further information, contact the Data Controller.
The User’s Personal Data may be transferred to a country other than the one in which the User is located. To obtain further information on the location of processing, the User may refer to the section detailing the processing of Personal Data.
You have the right to obtain information regarding the legal basis for the transfer of Data outside the European Union or to an international organization governed by public international law or established by two or more countries, such as the UN, as well as regarding the security measures adopted by the Data Controller to protect the Data.
If any of the transfers described above take place, the User may refer to the relevant sections of this document or request information from the Data Controller by contacting them using the contact details provided at the beginning of this document.
Retention Period
Data is processed and retained for as long as necessary to fulfill the purposes for which it was collected.
Therefore:
– Personal Data collected for purposes related to the performance of a contract between the Data Controller and the User will be retained until the performance of that contract is completed.
– Personal Data collected for purposes based on the Data Controller’s legitimate interest will be retained until that interest is satisfied. The User may obtain further information regarding the legitimate interest pursued by the Data Controller in the relevant sections of this document or by contacting the Data Controller.
– When processing is based on the User’s consent, the Data Controller may retain Personal Data for a longer period until such consent is revoked. In addition, the Data Controller may be required to retain Personal Data for a longer period to comply with a legal obligation or by order of an authority.
At the end of the retention period, the Personal Data will be deleted. Therefore, upon expiration of this period, the rights of access, erasure, rectification, and data portability can no longer be exercised.
Purposes of Processing the Collected Data
User Data is collected to enable the Data Controller to provide its Services, as well as for the following purposes: Statistics, Address Management and Sending Email Messages, Payment Management, Interaction with Social Networks and External Platforms, Contacting the User, SPAM protection, commercial affiliation, management of landing pages and invitation pages, content and functionality performance testing (A/B testing), management of user databases, heat mapping and session recording, interaction with online survey platforms, and interaction with live chat platforms.
For further detailed information on the purposes of processing and the Personal Data specifically relevant to each purpose, the User may refer to the relevant sections of this document.
Details on the Processing of Personal Data
Personal Data is collected for the following purposes and using the following services:
Contacting the User
Mailing List or Newsletter (This Site)
Upon subscribing to the mailing list or newsletter, the User’s email address is automatically added to a contact list to which email messages containing information—including commercial and promotional content—relating to this Site may be sent. The User’s email address may also be added to this list as a result of registering on this Site or after making a purchase.
Personal Data collected: Email, Name, Phone Number
Contact Form (This Site)
By filling out the contact form with their data, the User consents to its use to respond to requests for information, quotes, or any other purpose indicated in the form header.
Personal data collected: Email and Name, Phone Number, City, and all data necessary to respond to the User’s request.
Address Management and Email Delivery
These services allow us to manage a database of email contacts, phone numbers, or other types of contacts used to communicate with the User.
These services may also collect data regarding the date and time the User views messages, as well as the User’s interaction with them, such as information about clicks on links included in the messages.
Brevo
By subscribing to the mailing list or newsletter, the User’s email address is automatically added to a contact list to which email messages containing information—including commercial and promotional content—related to this Application may be sent. The User’s email address may also be added to this list as a result of registering for this Application.
Personal data collected: Email address and Name, as well as any other data necessary to meet the User’s needs.
TypeForm
TypeForm is a form creation and management service provided by TypeForm S.L. that allows this website to integrate such content into its pages.
Personal data collected: Email address and Name. Various types of data as specified in the service’s privacy policy.
Place of processing: Spain – Privacy Policy
SPAM Protection
These services analyze this Site’s traffic—which may contain Users’ Personal Data—in order to filter out traffic, messages, and content identified as SPAM.
Third-Party Service Account Access
These services allow this Site to retrieve Data from your accounts on third-party services and perform actions with that Data.
These services are not activated automatically but require the User’s express authorization.
Statistics
The services included in this section allow the Data Controller to monitor and analyze traffic data and are used to track User behavior.
Google Analytics (Google Inc.)
Google Analytics is a web analytics service provided by Google Inc. (“Google”). Google uses the Personal Data collected to track and examine the use of this Site, compile reports, and share them with other services developed by Google.
Google may use Personal Data to contextualize and personalize the ads in its advertising network.
Google also provides a browser add-on to disable Google Analytics at the following link: https://tools.google.com/dlpage/gaoptout?hl=it
Personal Data collected: Cookies and Usage Data.
Place of processing: USA – Privacy Policy – Opt Out
Donation/Payment Management
Donation management services allow this Site to process donations via credit card, bank transfer, or other methods. The data used for payment is collected directly by the provider of the requested payment service without being processed in any way by this Site.
Some of these services may also allow for the scheduled sending of messages to the User, such as emails containing invoices or payment notifications.
PayPal (PayPal)
PayPal is a payment service provided by PayPal Inc., which allows the User to make donations or online payments using their PayPal credentials.
Personal data collected: Various types of data as specified in the service’s privacy policy.
Place of processing: Luxembourg – Privacy Policy
Interaction with Social Networks
These services allow you to interact with social networks or other external platforms directly from the pages of this Site.
Interactions and information collected by this Site are in any case subject to the User’s privacy settings for each social network.
If a social network interaction service is installed, it is possible that—even if Users do not use the service—it may collect traffic data related to the pages on which it is installed.
Content on External Platforms
These services allow you to view content hosted on external platforms directly from the pages of this Site and to interact with it.
If a service of this type is installed, it is possible that—even if Users do not use the service—it may collect traffic data related to the pages on which it is installed.
YouTube Video Widget (Google Inc.)
YouTube is a video content display service operated by Google Inc. that allows this Site to embed such content within its pages.
Personal data collected: Cookies and usage data.
Place of processing: USA – Privacy Policy
Google Fonts (Google Inc.)
Google Fonts is a font display service operated by Google Inc. that allows this Website to integrate such content into its pages.
Personal data collected: Cookies and usage data
Place of processing: USA – Privacy Policy
Google Maps (Google Inc.)
Google Maps is a map display service operated by Google Inc. that allows this Site to embed such content within its pages.
Personal data collected: Cookies and usage data
Place of processing: USA – Privacy Policy
Google Translate (Google Inc.)
Google Translate provides an automatic translation of the Website into various languages that the user can select from the widget located at the top of each page of the site.
Personal data collected: Cookies and usage data
Place of processing: USA – Privacy Policy
Remarketing and Behavioral Targeting
These services allow this Site and its partners to communicate, optimize, and serve advertisements based on the User’s past use of this Site.
This activity is carried out by tracking Usage Data and using Cookies; this information is transferred to the partners associated with the remarketing and behavioral targeting activities.
Facebook Remarketing (Facebook, Inc.)
Facebook Remarketing is a remarketing and behavioral targeting service provided by Facebook, Inc. that links this Site’s activity with the Facebook advertising network.
Personal data collected: Cookies and Usage Data.
Place of processing: USA – Privacy Policy
DNS Services
CloudFlare is a traffic optimization and distribution service provided by CloudFlare Inc.
The way CloudFlare is integrated involves it filtering all traffic on this Site—that is, communications between this Site and the User’s browser—while also allowing for the collection of statistical data regarding that traffic.
Personal data collected: Various types of data as specified in the service’s privacy policy.
Place of processing: USA – Privacy Policy
CloudFlare _cfduid cookie: Read more