Information
on the use of tracking technologies through the APP pursuant to and for the
purposes of Article 13 of the EU Regulation 2016/679 ("GDPR").
With this
document, Lookalike intends to provide all necessary information on the
processing of Personal Data carried out on the App through the use of tracking
technologies (hereinafter "Tools" or "Tracking
Technologies") also pursuant to the "Cookie and other tracking tools
guidelines" of 10 June 2021 issued by the Italian Data Protection
Authority.
In order to
fully understand our policy on the protection of personal data, we invite the
Users to also read our Privacy Policy.
We would like
to point out that Lookalike provides links to third party partner platforms,
where the Users can purchase products or fashion items. In these cases, the
provisions on data protection applied by these third party
platforms will be applied in addition to what is contained in this privacy
policy, and the Users are therefore invited to read it.
1. Data
Controller and Data Protection Officer
The data
controller is Lookalike S.r.l., with registered
office in Via del Gonfalone 3, 20123 Milan (MI),
P.I./C.F. 11814320963, pec lookalikesrl@pec.it, (the "Data
Controller").
The company has
appointed a Data Protection Officer (DPO) who can be reached at the company's
address in Via del Gonfalone 3, 20123 Milan (MI) and
by e-mail at dpo@lookalike.shop.
2.
Information collected through tracking technologies and purpose of
processing
The App uses
Tracking Technologies for different purposes. In particular, it uses:
-
Technical tools necessary for
the operation of the App, including the provision of the services offered by
the App. Among these Tracking Technologies are included the Navigation or
Session Tools, which guarantee the normal navigation and use of the App and
Functionality Tools, which allow the User to navigate according to a series of
selected criteria (for example, the language) in order to improve the service
rendered.
-
Analytical Tools used to
perform statistical analysis on how Users navigate the App or to help measure
their "traffic" based on certain characteristics. These identifiers
can be included in the category of technical identifiers, and as such can be
used without the prior consent of the interested party, only in the following
cases: use only to produce aggregate statistics and in relation to a single
mobile application; use of data minimization measures that significantly reduce
the power of identification; abstention of the third party from combining this
information with other processing or from transmitting it to other third
parties.
-
Own and third-party profiling
tools, aimed at tracing specific recurring actions to Users in the use of the
offered functionalities, in order to group them in homogeneous groups and to
customize the service, as well as to send targeted advertising messages, i.e. in line with the preferences expressed by the User
during navigation on the App.
Tracking Tools
can be "first party" when they are set up and managed directly by the
Owner and "third party" when they are managed by a different domain
than the current one.
With regard to
"third-party" Tools, the Controller plays a role of technical
intermediary. The Data Controller has no responsibility for the operation on
the App of third party Tools and the management of
information collected by third parties is governed by the relevant disclosures
to which please refer.
3. Legal
Basis
While the use
of technical tools does not require the User's consent, the use of profiling
tools and analytical tools that are not comparable to technical tools always
requires the User's consent. Consent is always optional and, if given, may be
revoked at any time without prejudice to the processing carried out prior to
revocation.
With regard to
non-technical tools, the legal basis for processing is therefore the consent of
the person concerned (art. 6 par. 1 lett. a) GDPR),
for technical tools, by virtue of the function performed, their use falls
within a codified hypothesis of exemption from the obligation to acquire the
consent of the person concerned (art. 122 of the Privacy Code); the legal basis
can be found in 'art. 6 par. 1 lett. b) of the GDPR
as the treatments are necessary for the provision of services provided through
the App.
When the User
visits the App for the first time, he will see a banner regarding the use of
Tracking Technologies and he can either accept all the
Tools or choose to close the banner and continue browsing only with the default
settings and therefore only with the Technical Tools.
It will be
possible to manage and disable preferences with respect to the different types
of Tracking Technologies by accessing the dedicated control tool, when
accessing the App or subsequently.
4. Tools used
in the App
The App uses
the Tracking Tools indicated in the following table where the purposes,
retention time and the link to the third party policy
are also reported:
|
Service |
Purpose |
Origin |
Duration |
Link to indormation |
|
Facebook login |
Technical |
Third Party |
Session |
|
|
Facebook ads |
Profiling |
Third Party |
30days |
|
|
LinkedIn Ads |
Profiling |
Third Party |
30days |
https://www.linkedin.com/legal/cookie-policy?trk=hb_ft_cookie |
|
Google sign-in |
Technical |
Third Party |
Session |
|
|
Google Ads |
Profiling |
Third Party |
30days |
|
|
Google Tag |
Analytics |
Third Party |
24hours |
|
|
Twitter Ads |
Profiling |
Third Party |
30days |
|
|
Instagram Ads |
Profiling |
Third Party |
30days |
|
|
HasOffers |
Analytics |
Third Party |
30days |
|
|
Tune |
Analytics |
Third Party |
30days |
https://help.tune.com/hasoffers/the-importance-of-securing-data-in-hasoffers/ |
|
Adjust |
Analytics |
Third Party |
Session |
|
|
Apple sign-in |
Technical |
Third Party |
Session |
|
|
Usercentrics |
Technical |
Third Party |
6 months |
5. Profiling
tools
The Data
Controller informs that the App makes use of Tracking Technologies for
profiling purposes. The profiling services used allow the Owner to communicate,
optimize and serve advertisements based on the use of the App by the User.
Information is also transferred to partners to which this activity is linked.
These third party tracking technologies and their use
are not controlled by the Owner and the consent acquired for third party Tools
through the App is covered by their privacy policies. In short, the consent to
the use of third party tools is made up of two
elements that are both necessary: on the one hand the presence of the banner,
which generates the event that makes the consent documentable and, on the other
hand, the presence of updated links to the sites managed by third parties
through which the User can make his choices about the categories and subjects
from which to receive profiling tools.
6. Recipients
of Personal Data
Personal Data
resulting from Tracking Technologies may be communicated by the Controller to
the categories of recipients indicated below.
-
Subjects responsible for
processing pursuant to art. 28 GDPR as they process Personal Data on behalf of
the Owner such as companies that offer management and maintenance services for
the App and the information systems.
-
Persons authorised
to process pursuant to art. 2 quaterdecies of the
Privacy Code (Legislative Decree 196/2003 as amended by Legislative Decree
101/2018) who act internally under the control and direction of the Data Controller
such as employees and collaborators who carry out activities closely related to
the provision of the services on the App.
-
Persons to whom the Data
Controller communicates the Data and who act, according to the requirements of
the law, as autonomous data controllers in that they determine the purposes and
means of processing such as public security or regulatory bodies, government
agencies or judicial authorities where required by the applicable legislation.
In any case,
Personal Data will only be disclosed to persons who have committed themselves
to confidentiality or have an adequate legal obligation of confidentiality.
Personal Data will not be disclosed.
7. Period of
data retention and processing methods
Personal Data
deriving from Tracking Technologies are stored only for the period necessary
for the purpose for which they are processed or within the terms provided by
applicable national and community laws, rules and regulations. The retention
time for each Tracking Technology is however indicated in the table containing
the list of Tools used.
Thereafter,
Personal Data will be deleted in accordance with our Data Retention and
Deletion Rules or will be retained in relation to an additional legal basis that
still exists.
8. Transfer of
Personal Data outside the European Union
For certain
processing activities of Personal Data derived from the Tracking Technologies,
Lookalike may transfer such Data to external parties located in countries that
do not belong to the European Union (EU) or the European Economic Area (EEA)
(hereinafter, "Third Countries"). The list of Third Countries will be
updated from time to time and available upon request; the legitimacy of such
transfer is, in any case, carried out in compliance with the appropriate and
adequate safeguards for the purposes of the transfer itself and in particular
in compliance with the general principle for transfer set out in Art. 44 GDPR,
the existence of an adequacy decision of the European Commission pursuant to
Art. 45 GDPR, of adequate safeguards pursuant to Article 46 GDPR - including
the standard data protection clauses adopted by the Commission in accordance
with the examination procedure referred to in Article 93(2) GDPR - and in the
presence of one of the specific situations of derogation referred to in Article
49 GDPR, including the explicit consent to the transfer by the Data Subject.
9. Obligation
to communicate personal data and consequences of non-communication
There is no
obligation for the User to give consent to the use of Tracking Technologies;
the User is not subject to any consequences in the event of non-acceptance of
such Tools, being able, in any case, to use the services offered by the App.
It is important
to remember that the complete deactivation of all Tools, including the
technical ones, may result in the abnormal functioning of the Platform being
visited.
10. Data Rights
Pursuant to
Article 15 et seq. of EU REG 2016/679, the User may exercise the following
rights: (1) request access to their Personal Data pursuant to art. 15 of the
GDPR, (2) obtain the rectification and/or integration of the Data pursuant to
art. 16 of the GDPR, (3) request and obtain the deletion of the Data pursuant
to and within the limits of art. 17 of the GDPR unless one of the exceptions
referred to in paragraph 3 of the same art. 17 applies, (4) request and obtain
the restriction of the processing pursuant to art. 18 of the GDPR, (5) obtain
the portability of the Data pursuant to and within the limits of art. 19 of the
GDPR which allows the User to receive the Personal Data provided to the
Controller in a structured, commonly used and machine-readable format and -
under certain conditions - transmit it to another data controller without
hindrance, (6) object, in whole or in part, to certain types of processing
pursuant to art. 21 of the GDPR, including processing for marketing purposes,
(7) withdraw consent pursuant to Art. 7(3) of the GDPR without affecting the
lawfulness of the processing based on the consent given prior to withdrawal,
(8) lodge a complaint with the Supervisory Authority (Privacy Guarantor), (9)
receive clear, transparent and easily understandable information on how
Personal Data is used and the exercise of rights, which is why the Controller
provides the information contained in this document (Art. 13 GDPR).
The exercise of
rights is not subject to any formal constraints and is free of charge. All
rights may be exercised by sending an appropriate request to the Data
Controller at the following e-mail address: privacy@lookalike.shop.