Privacy Policy

thecostieracollective.com

Introduction

For The Costiera Collective (“TCC”), your privacy and the security of your personal data are very important to us. We collect and manage your personal data with the utmost care and adopt specific measures to keep it safe.

Below you will find the main information on TCC’s processing of your personal data in connection with your browsing and use of the services offered. For detailed information on how TCC manages your personal data, please continue reading.

This notice is provided in accordance with Articles 13 and 14 of EU Regulation 679/2016 (“GDPR”) to users (“Users” or “User”) of the desktop and mobile version of the website and any mobile application related to the service (“Website”) owned by TCC, Data Controller (“Controller”), and is intended to describe how the Site is managed with reference to the processing of personal data, as well as to allow Users of the Site to understand the purposes and methods of personal data processing carried out by the Controller when they provide their data.

As specified in the Terms and Conditions of the service, the services offered by the Controller are directed to persons over 14 years of age. Pursuant to Article 8 of the GDPR and Article 2-quinquies of Legislative Decree 101/2018, should the Controller become aware of the processing of data belonging to minors under 14 without the valid consent of a parent or legal guardian, it reserves the right to unilaterally discontinue the service and delete the data acquired. We also invite you to read the “Cookie Policy” and “Terms and Conditions” of www.thecostieracollective.com, which contain detailed information on the conditions relating to our services.

Principles applicable to the processing of personal data

The Controller, pursuant to the GDPR, gives notice that the regulation provides for the protection of individuals with respect to the processing of personal data and that such processing will be based on principles of fairness, lawfulness, transparency, and the protection of confidentiality and fundamental rights.

Definitions

The term “User” refers to any individual who accesses or browses the Site for any purpose. The Site is purely informational and promotional in nature: it does not offer user registration, booking, or online purchasing functionality. A User who wishes to contact TCC, request information, or propose a collaboration may do so by email or through the Site’s contact form, as described below.

The term “Talent” refers to a content creator, influencer, or other communications professional who applies to TCC, or is engaged by TCC, for representation, brand partnership, or related services.

What personal data do we collect?

The IT systems and software procedures underlying the operation of the Site acquire, in the course of their normal operation, certain personal data whose transmission is implicit in the access and operating mechanisms and protocols used on the Internet.

Every time a User connects to the Site and every time they access or request content, access data is stored on our systems in the form of tabular or linear data files.

This category of data includes, for example, IP addresses, the domain names of computers used by users connecting to the Site, requests made by the User’s browser in URI (Uniform Resource Identifier) notation, the date and time of the request to the server, the method used to submit the request, the amount of data transmitted, the numeric code indicating the status of the response given by the server, and other parameters relating to the User’s operating system and computing environment.

In addition, the categories of personal data that TCC collects and processes when you browse the Site or contact us are as follows:

• Technical data necessary for the operation and security of the Site (e.g. IP address, user-agent, technical logs).
• Contact data: information provided voluntarily by email (first name, last name, email, phone, and message content).
• Client contractual and tax data: company name, address, billing email, VAT number, and other data contained in contracts and invoices.

We do not collect special categories of data (e.g. health data) or data relating to minors through the Site.

How do we use the personal data collected? Purposes, legal basis, and whether provision is mandatory

Personal data collected by the Controller through use of the Site will be processed, with the consent of data subjects, for the purposes described below:

• Managing requests sent by email or other contact channels (legal basis: consent and pre-contractual measures requested by the data subject);
• Performance of contracts, e.g. brand partnership and creator collaboration agreements, and fiscal/accounting obligations (legal basis: contract performance and legal obligation);
• Security and operation of the Site, prevention of abuse and fraud (legal basis: legitimate interest).

How personal data is processed and retained

The Controller ensures that personal data is processed in full compliance with the GDPR, in paper and/or electronic form, including through the use of automated procedures. Processing may also be carried out through automated tools designed to store, manage, and transmit data.

Data collected and processed will be protected with physical and logical safeguards designed to minimize the risk of unauthorized access, disclosure, loss, and destruction of data, pursuant to Articles 25 and 32 of the GDPR.

Data processing will last no longer than necessary to fulfil the purposes for which it was collected.

Pursuant to Article 7(3) of the GDPR, data subjects may, at any time and easily, withdraw their consent to processing and request deletion of their personal data by sending a communication to the Controller. Following a deletion request, all of the User’s personal data will be deleted, subject to further retention required by law.

The Controller notes that a User who has requested removal from the Site may still receive a limited number of further communications after such request, due to the time required for the Controller’s systems to process the unsubscribe and deletion procedure. In any case, the Controller ensures that within a maximum of ten days from the deletion request, the User will receive no further communications and their data will be deleted, subject to any further legal obligations.

Absent a deletion request, personal data will be retained for a period not exceeding 2 (two) years from the date of the User’s last access to the Site.

Who will process your data? Recipients of personal data

Your personal data is processed by personnel duly instructed by TCC as Data Controller. For organizational and operational needs relating to the provision of TCC’s services, your data may also be processed by our suppliers. The personal data collected may be processed by parties or categories of parties acting as Data Processors pursuant to Article 28 of the GDPR or who are authorized to process data pursuant to Article 29 of the GDPR.

In addition, for certain services, data may be shared with companies that collaborate with or use the Controller’s services solely to deliver the services requested by the User. In these cases, such partners are independent controllers, and the Controller is not responsible for their processing of the data. The Controller is also not responsible for the content of, or compliance with data protection law by, sites not operated by the Controller.

Outside of the above, personal data will not be disclosed except to parties, entities, and authorities to whom disclosure is mandatory under law or regulation.

Rights of the data subject

Pursuant to Articles 15 to 22 of the GDPR, the User, as a data subject, has the right to exercise specific rights concerning their personal data. In particular, the data subject has the right to obtain:

• Confirmation of whether or not personal data concerning them exists, even if not yet recorded, in a concise, transparent, intelligible, and easily accessible form, using clear and plain language;
• Information on the origin of the personal data; the purposes and methods of processing; the legitimate interests pursued by the Controller or third parties; any recipients or categories of recipients of personal data; any intention of the Controller to transfer personal data to a third country or international organization; the retention period; the logic applied, as well as the significance and expected consequences of such processing, where processing is carried out by electronic means as part of automated collection and/or profiling; the identifying details of the Controller, Processors, any designated Representative, and the Data Protection Officer (DPO); the parties or categories of parties to whom personal data may be disclosed;
• The ability to lodge a complaint with a supervisory authority;
• Updating, rectification, or, where relevant, completion of the data;
• Erasure, anonymization, or blocking of data processed unlawfully, including data whose retention is not necessary for the purposes for which it was collected or subsequently processed;
• Restriction of processing;
• Portability of their personal data to another Controller;
• Withdrawal of consent to processing;
• Objection, in whole or in part, on legitimate grounds, to the processing of personal data concerning them, even where pertinent to the purpose of collection.

Right to erasure of personal data

You may request deletion of your collected data at any time by sending a request through the Site or by writing to the Controller at ciao@thecostieracollective.com, using the subject line: “User data deletion request – FIRST AND LAST NAME – for TCC.” Following your request, the Controller will promptly delete the data collected on your behalf. Deletion will be confirmed by email to the address you provide.

You may request deletion of your data in the following cases:

• The data is no longer necessary for the purposes for which it was collected;
• You withdraw your consent to processing and there is no other legitimate ground for processing;
• You object to processing and there is no overriding legitimate ground to continue, e.g. where data is processed for profiling or direct marketing;
• The data has been processed unlawfully;
• The data collected relates to a minor under 14 years of age, unless consent was given or authorized by the holder of parental responsibility;
• In all other cases where deletion is required under EU or Member State law applicable to the Controller.

The Controller will act on a deletion or consent-withdrawal request without undue delay and, at the latest, within one month of receipt, extendable to three months for particularly complex requests (with the data subject informed of the reason for the delay within one month of the request). Deletion is free of charge, except where requests are manifestly unfounded, excessive, or repetitive.

Data Controller

The Data Controller is:

THE COSTIERA COLLECTIVE S.R.L.

Registered office: Via Casaraia, 57, 80049 Somma Vesuviana (NA), Italy

VAT / Tax ID: 11108531218

Email: ciao@thecostieracollective.com

PEC: thecostieracollective@pec.it

To exercise the rights described above, data subjects may contact the Controller at any time using the details above, including to request the updated list of any Data Processors appointed by the company.

Changes

This notice may be subject to change. To stay up to date, the Controller invites Users to periodically visit this page. In addition, should such changes affect User data (for example, if the Controller intends to process User personal data for purposes other than those previously communicated in this notice), the Controller will inform the User before such changes take effect, publishing them prominently on its Site.