PRIVACY POLICY

This privacy policy aims to provide all information on the processing of personal data carried out by BOEM S.r.l when the User accesses and browses the present site www.drinkboem.com (as better indicated below).

1. INTRODUCTION - WHO ARE WE?

BOEM S.r.l with registered office at Via Raffaello Sanzio 22, 20149, Milan (MI), Tax Code/VAT No. 12978040967 (hereinafter, "Owner"), owner of the website www.drinkboem.com (hereinafter, the "Site"), as the data controller of the personal data of users browsing the site (hereinafter, "Users"), hereby provides the privacy policy pursuant to art. 13 of EU Regulation 2016/679 of April 27, 2016 (hereinafter, "Regulation", or "Applicable Law").   
 

2. HOW TO CONTACT US?

 The Owner highly values the right to privacy and the protection of personal data of its Users. For any information regarding this privacy policy, Users can contact the Owner at any time, using the following methods:
- By sending a registered letter with return receipt to the Data Controller's registered office at Via Raffaello Sanzio 22, 20149, Milan (MI),
- By sending an email to: info@drinkboem.com. Users can also contact the Data Protection Officer (DPO) of the Owner, whose contact details are provided below: the company Shibumi S.r.l. - email: dpo@drinkboem.com

3. WHAT DO WE DO? – PURPOSE OF PROCESSING

Through browsing the Site, the User can:
- always stay updated regarding the Owner's products and services,
- create a personal Account (hereinafter, "Account"),
- purchase the products offered for sale on the Site (hereinafter, "Purchase"),
- share requests or content with the Owner, by sending messages through the "Write to Us" form or through the Owner's social channels (hereinafter, "Contacts"). (all together, the "Service").
- send job applications using the "Work with Us" section (hereinafter, "Work with Us");
- join the Site community to receive news, promotional communications, updates, and discount codes (hereinafter, "Community").
In relation to the activities that can be carried out through the Site, the Owner collects personal data relating to the Users.
This Site and the services possibly offered through the Site are reserved for individuals who have reached the age of eighteen. In fact, the Owner requires access to the Site to be subject to the declaration of majority age by its Users.
The Data Controller therefore does not collect personal data relating to individuals under 18 years of age.
In particular, Users' personal data will be lawfully processed by the Data Controller for the following processing purposes:
a) contractual obligations and Service provision,
i) to allow navigation of the Site,
ii) to allow the User to register on the Site by creating a personal Account,
iii) to follow up on all actions performed by the User through the “Contacts” service,
iv) to allow the Purchase to be made and
v) to fulfill specific requests from the User.
The User data collected by the Data Controller for these purposes include, depending on the case: browsing data (for more details Users are invited to read the Cookie Policy of the Site), first name, last name, date of birth, delivery address, email address, phone number, and billing data (if different from the purchase data) as well as any additional data that may be necessary depending on the circumstances (for example, order number and/or products purchased in case of customer care requests, etc.).
Unless the User gives the Data Controller a specific and optional consent to the processing of their data for the additional purpose provided in the following paragraph, the User's personal data will be used by the Data Controller exclusively to verify the User's identity (also through validation of the email address), thus avoiding possible fraud or abuse, and to contact the User for service reasons only (e.g., sending notifications related to products and services offered on the Site). Without prejudice to what is provided elsewhere in this privacy policy, under no circumstances will the Data Controller make the Users' personal data accessible to other Users and/or third parties.b) administrative-accounting purposes, that is, to carry out organizational, administrative, financial, and accounting activities, such as internal organizational activities and activities functional to the fulfillment of contractual and pre-contractual obligations;
c) legal obligations, that is, to comply with obligations established by law, by an authority, by a regulation, or by European legislation.
Providing personal data for the processing purposes indicated above is optional but necessary, as failure to provide such data will result in the User being unable to use the Service.
The personal data necessary for the purposes of processing described in this paragraph 3 are indicated with an asterisk within the registration form on the Site.

4. ADDITIONAL PURPOSES OF PROCESSING 

4.1 Community Registration - Marketing (sending advertising material, direct sales, and commercial communication)
Some personal data of the User (namely e-mail address and date of birth) may also be processed by the Data Controller for marketing purposes (sending advertising material, direct sales, and commercial communication), i.e., to receive commercial communications from the Data Controller via e-mail including, by way of example and not limited to: news, promotional communications, updates, discount codes, offers, promotions, commercial opportunities, participation in customer satisfaction surveys and/or market research.
In particular, the User may consent to receive such communications through (i) the specific forms visible on the Site (static or pop-up), as well as (ii) a specific check-box possibly presented within the forms on the Site. In case of no consent, the possibility to use the Service will not be prejudiced in any way.
In case of consent, the User may revoke it at any time by requesting the Data Controller using the methods indicated in the following paragraph 8.
The User may also easily object to further sending of promotional communications via e-mail by clicking on the specific link for consent withdrawal, which is present in each promotional e-mail. Once the consent withdrawal is made, the Data Controller will confirm to the User that the consent has been withdrawn.
The Data Controller informs that, following the exercise of the right to object to receiving promotional communications via e-mail, it is possible that, for technical and operational reasons (e.g., contact list formation already completed shortly before the Data Controller received the objection request), the User may continue to receive some further promotional messages. If the User continues to receive promotional messages after 24 hours from exercising the right to object, please report the issue to the Data Controller using the contacts indicated in the following paragraph 8.
4.2 Management of applications ("Work with us")
Some personal data of the User (namely first name, last name, date of birth, e-mail, phone number, residence, Curriculum Vitae, presentation video) may be processed by the Data Controller to follow up on their application, submitted through the Site or other recruiting channels of the Data Controller. Regarding the presentation video possibly requested from the Candidate, the Data Controller will process only the personal data indicated in the “Content tips” section available on the Site. Additional personal data, possibly present in the video and not identified in that section, will not be processed by the Data Controller.
The personal data necessary to pursue the processing purposes described in this paragraph 4.2 are indicated with an asterisk within the relevant form.

5. LEGAL BASIS 

Contractual obligations and service provision (as described in the previous par. 3, letter a)) and Management of applications ("Work with Us") (as described in the previous par. 4.2): the legal basis consists of art. 6, paragraph 1, letter b) of the Regulation, i.e., the processing is necessary for the performance of a contract to which the User is a party or for the implementation of pre-contractual measures adopted at their request.

Administrative-accounting purposes (as described in the previous par. 3, letter b)): the legal basis consists of art. 6, paragraph 1, letter b) of the Regulation, as the processing is necessary for the performance of a contract and/or the implementation of pre-contractual measures adopted at the User's request.
Legal obligations (as described in the previous par. 3, letter c)): the legal basis consists of art. 6,
paragraph 1, letter c) of the Regulation, as the processing is necessary to comply with a legal obligation to which
the Data Controller is subject.
Additional processing purposes: for processing related to the activity of Registration to the Community - marketing, (as described in the previous par. 4), the legal basis consists of art. 6, paragraph 1, letter a) of the Regulation, i.e., the provision by the data subject of consent to the processing of their personal data for one or more specific purposes. For this reason, the Data Controller asks the User to provide a specific free and optional consent to pursue this processing purpose.

6. METHODS OF PROCESSING AND DATA RETENTION TIMES 

The Data Controller will process the Users' personal data using manual and IT tools, with logic strictly related to the purposes themselves and, in any case, in a way that guarantees the security and confidentiality of the data.
The personal data of the Site Users will be kept for the time strictly necessary to fulfill the primary purposes illustrated in the previous paragraph 3, or in any case as necessary for the protection of the interests of both the Users and the Data Controller in civil proceedings.
In the cases referred to in the previous paragraph 4, the personal data of Users will be kept for the time strictly necessary to fulfill the purposes illustrated therein and, in any case, as long as the User does not withdraw their consent to participate in the Community.
In the cases referred to in the previous paragraph 4.2, the personal data of Candidates will be kept for 2 years from the date of application, except in the case of hiring, for which the retention periods indicated at the time of providing the information notice intended for employees or collaborators will apply.

7. SCOPE OF COMMUNICATION AND DISCLOSURE OF DATA

The User's personal data may be transferred outside the European Union in the context of the provision of Services; such data may be transferred to other countries, including Canada and the United States, and, in such cases, the Data Controller will ensure that the transfer takes place in accordance with the Applicable Regulation and, in particular, in accordance with art. 45 (Transfer based on an adequacy decision) of the Regulation. 
Employees and/or collaborators of the Data Controller responsible for managing the Site and Users' requests may come to know the Users' personal data. These subjects, who have been instructed accordingly by the Data Controller pursuant to art. 29 of the Regulation, will process Users' data exclusively for the purposes indicated in this privacy notice and in compliance with the provisions of the Applicable Regulation.
Third parties who may process personal data on behalf of the Data Controller may also come to know the Users' personal data
- as Data Processors, such as, by way of example, providers of IT and logistics services functional to the operation of the Site and marketing communications, e-commerce service providers, managers of logistics services necessary for the delivery of goods sold through the Site;
- as independent Data Controllers, such as, by way of example, providers of payment services available on the Site.
Users have the right to obtain a list of any data processors appointed by the Data Controller, by requesting it from the Data Controller using the methods indicated in the following paragraph 8.

8. RIGHTS OF THE DATA SUBJECTS 

Users may exercise the rights guaranteed to them by the Applicable Regulation by contacting the Data Controller using the following methods:

- By sending a registered letter with return receipt to the Data Controller's registered office at Via Raffaello Sanzio 22, 20149, Milan (MI),
- By sending an email to: info@drinkboem.com
The Data Controller has not identified the figure of the Data Protection Officer (RPD or DPO), as it is not subject to the designation obligation provided for by art. 37 of the Regulation.
Pursuant to the Applicable Regulation, the Data Controller informs that Users have the right to obtain the indication
(i) of the origin of personal data;
(ii) of the purposes and methods of processing;
(iii) of the logic applied in case of processing carried out with the aid of electronic tools;
(iv) of the identification details of the owner and the processors;
(v) of the subjects or categories of subjects to whom personal data may be communicated or who may become aware of them as data processors or persons in charge.
Furthermore, Users have the right to obtain:
a) access, updating, rectification or, when interested, integration of the data;
b) the deletion, the transformation into anonymous form, or the restriction of data processed unlawfully, including those whose retention is not necessary in relation to the purposes for which the data were collected or subsequently processed;
c) the certification that the operations referred to in letters a) and b) have been brought to the attention, including their content, of those to whom the data have been communicated or disseminated, except where such compliance proves impossible or involves the use of means manifestly disproportionate to the protected right.
Furthermore, Users have:
a) the right to withdraw consent at any time, if the processing is based on their consent;
b) the right to data portability (the right to receive all personal data concerning them in a structured, commonly used, and machine-readable format);
c) the right to object:
i) in whole or in part, for legitimate reasons to the processing of personal data concerning them, even if relevant to the purpose of collection;
ii) in whole or in part, to the processing of personal data concerning them for the purpose of sending advertising material or direct sales or for carrying out market research or commercial communication;
iii) if personal data are processed for direct marketing purposes, at any time, to the processing of their data carried out for such purposes, including profiling to the extent that it is related to such direct marketing.
d) if they believe that the processing concerning them violates the Regulation, the right to file a complaint with a Supervisory Authority (in the Member State where they usually reside, where they work, or where the alleged violation occurred). The Italian Supervisory Authority is the Garante per la protezione dei dati personali, located at Piazza Venezia n. 11, 00187 – Rome (http://www.garanteprivacy.it/).
_____________

The Owner is not responsible for updating all the links viewable in this Privacy Policy, therefore, whenever a link is not working and/or updated, Users acknowledge and accept that they must always refer to the document and/or section of the websites referenced by that link.