Joint Ownership Agreement Extract

PROCESSING OF PERSONAL DATA FOR PURPOSES OF MIGRATION OF OLD USERS, MANAGEMENT OF USERS, DIRECT MARKETING, POSTAL MARKETING AND PROFILING ON PURCHASE DATA AND PROFILING ON NAVIGATION DATA

Unilever Italia Mkt. Operations S.r.l., with registered office in Rome, Via Paolo di Dono no. 3/A (hereinafter referred to as “Unilever”) and Equilibra S.r.l., with registered office in Turin, Via Plava no. 74, (hereinafter “Equilibra”) (collectively, the “Parties”).

The Parties are part of the same Unilever group of companies active in the distribution of consumer goods. The Parties mutually guarantee that they are aware of and will apply all the regulations currently in force on the protection of personal data relevant to their respective activities.

With a view to optimising the group synergies in the field of e-commerce, participating in online contests and commercial notices, the Parties intend to follow a strategy aimed at implementing a group marketing policy based on pursuing both the interests of companies and brands and those of end users. More specifically, the Parties intend to enhance the variety and complementarity of the products offered by each on the market, simplifying the online shopping experience for users and offering them the possibility to easily access information and notices relating to the products.

These purposes will be pursued by the Parties through: i) the creation of digital spaces for e-commerce and online contests based on a single technological platform allowing users to access the personal areas of the Parties’ websites with a single user; ii) joint management of direct marketing, mail marketing, profiling of navigation data and profiling of purchase data within the websites the user may choose to register to make purchases or enter contests. In the registration form, in addition to personal data, you will be asked to give your consent for the following purposes: direct marketing, postal marketing, profiling of purchases. The purposes will be pursued by the Parties on a joint basis; in fact, the methods of sending commercial communications and the logic behind the profiling will be determined jointly. Through registration, the user will be assigned a single user account valid for the reserved areas of the websites www.dettofranoi.it, www.equilibra.it and other websites that the Parties decide to create.

 

CLAUSE 1: RECITALS AND ANNEXES

[OMISSIS]

 

CLAUSE 2: PROCESSING OPERATIONS

The processing operations covered by this co-ownership agreement pursue the following purposes: migration of old users, management of users, direct marketing, postal marketing, profiling of purchase data and profiling of navigation data.

[OMISSIS]

 

CLAUSE 3: SCOPE

With the execution of this Co-ownership Agreement (Clause 26 of the Regulation) the Parties, with respect to the processing activities described under Clause 2 above, set forth the following:

a) [OMISSIS]

b) [OMISSIS]

c) [OMISSIS]

d) Information to be provided to the data subjects pursuant to Article 13 of the Regulation as well as collection/management of consent (policy and requests for consents): the privacy policy to be provided to the data subject during the registration project, together with the relevant requests for consent, the privacy policy and the cookie policy will be provided by Unilever to the company in charge of managing the content of the websites, which will publish them. The documents mentioned above will be prepared in accordance with the provisions of the Regulation and the relevant provisions of the Data Protection Authority.

e) Requests from Data Subjects: Unilever shall act as a point of contact for data subjects for the purpose of handling requests from data subjects pursuant to Articles 15 and ff. of the Regulation concerning the processing operations covered by this Agreement. In these cases, Unilever undertakes to ascertain in advance the identity of the persons concerned to verify the legitimacy of the request. In any case, Data Subjects may exercise their rights against either of the two Parties which shall fulfil them.

f) [OMISSIS]

g) Adoption of appropriate security measures pursuant to Article 32 of the Regulation: more specifically, the Parties undertake to ensure a level of security appropriate to the risk, taking into account, specifically, the risks that could arise from the specific processing operations covered by the Agreement, such as, for example, destruction or loss, even accidental, of the data, as well as unauthorised access or processing that is not permitted or not in keeping with the purposes of data collection. [OMISSIS]

h) Timely notification of any breaches of personal data to the Supervisory Authority and to the data subject in cases where such obligations are due, pursuant to Articles 33 and 34 of the Regulation: without prejudice to mutual cooperation, each Party shall act independently.

i) [OMISSIS]

 

CLAUSE 4: REVOCATION

[OMISSIS]

 

CLAUSE 5: EFFECTIVE DATE AND TERM

[OMISSIS]

 

CLAUSE 6: MODIFICATIONS TO THE AGREEMENT

[OMISSIS]