Privacy Policy - Newsletter

The purpose of this privacy policy provides all the information on the processing of personal data carried out by the Yeldo Group, when the User subscribes to the newsletter (as indicated below).

Introduction – Who are we?

Yeldo S.A., with registered offices in Viale Stefano Franscini 3 – 6900, Lugano, Switzerland, Tax Code/VAT No. CHE-255.680.014, a subsidiary company belonging to the Yeldo Group S.A. with registered offices in 3 Rue Belle-Vue, L - 1227 Luxembourg, Grand Duchy of Luxembourg, RCS Luxembourg: B207881, together with other subsidiaries of the Yeldo Group, Y-Crowd S.r.l., with registered offices in Via Borgogna 5 – 20112, Milano, Italy, P.IVA n. 11813600969 and YELDO GmbH, with registered offices in Potsdamer Platz 1, 10785 Berlin, Haldelsregister Berlin No.: HRB 241384 B (hereinafter, “Joint Controllers”), in their capacity as Joint Controllers of the personal data of users wishing to subscribe to the mailing list (hereinafter, the “Users”) hereby provides the privacy policy pursuant to art. 13 of the Regulation EU 2016/679 of the Council of 27 April 2016 (hereinafter, “Regulation” or “Applicable Law”).

Yeldo S.A., established outside the European Union and providing services to subjects resident in the European Union, will process the personal data of Users browsing the Website and subscribing to the newsletter in full compliance with the Applicable Law, pursuant to Article 3(2)(a) of the Regulation.

How to contact us?

The Yeldo Group takes the utmost account of its Users’ right to privacy and protection of personal data. For any information related to this privacy policy, Users may contact the Joint Controllers at any time by sending an e-mail to: privacy@yeldo.com

The Users may also contact the Data Protection Officer (DPO) appointed by the Yeldo Group. The contact details of the DPO are: Shibumi S.r.l., in the person of Lapo Curini Galletti, email: dpo@yeldo.com.

Yeldo S.A., established outside the European Union, has appointed as its Representative in the European Union, pursuant to Article 27 of the Regulation, the company Yeldo S.r.l., with registered office in Milano, Via Borgogna 5.

Essence of the Joint Controllership Agreement

In accordance with Article 26 of the Regulation, the Joint Controllers have determined, by means of an internal agreement, their respective responsibilities for compliance with the obligations arising under the applicable data protection legislation.

Pursuant to Article 26(2) of the Regulation, the essence of the agreement entered into between the Joint Controllers is set out below:

(i) they have jointly determined the purposes and means of the processing of Data Subjects' personal data;
(ii) they have jointly defined this privacy policy, indicating all the information required by the Regulation;
(iii) with reference to the management of Users' requests pursuant to Articles 15-22 of the Regulation, they have determined that the management of the procedure for providing a response shall be entrusted to Yeldo S.A., which may be contacted for request regarding personal data at the following email address: privacy@yeldo.com;
(iv) where personal data are transferred to countries outside the European Economic Area, the Joint Controllers shall each ensure, with respect to the processing activities falling within their respective areas of responsibility, that such transfers are carried out in compliance with Applicable Law.

Therefore, in light of the foregoing, pursuant to Article 13 of the Regulation, the Joint Controllers provide this privacy policy.

What do we do? – Processing Purposes

By subscribing to the mailing list, the User will receive a periodic newsletter from the Joint Controllers, which will contain information and updates, also of a promotional and commercial nature, relating to the services and activities of the Joint Controllers (hereinafter, the "Service").

The companies that are part of the Yeldo Group have signed an agreement defining the shared management of the activity of sending promotional and/or commercial communications. The main control of this activity is performed by Yeldo S.A., which verifies that the contents of the communications comply with the general and special applicable legislations, including the provisions of the competent authorities. The object of the communications, on the other hand, is defined by Yeldo S.A. in coordination with the individual companies of the Group.

Particularly, the personal data of the Users will be lawfully processed for the following purposes:

processing of the User’s request: Users’ personal data are collected and processed by the Joint Controllers for the sole purpose of fulfilling the latter's request concerning the sending of the newsletter. Therefore, the User will receive from the Joint Controllers a periodical newsletter that will contain information and updates, also of promotional and commercial nature, related to the services and activities of the Joint Controllers. The User data collected by the Joint Controllers for this purpose may include: first name, last name, e-mail address, phone number. No other processing will be carried out by the Joint Controllers in relation to the Users' personal data. Notwithstanding the provisions provided elsewhere in this privacy policy, under no circumstances shall the Joint Controllers make Users' personal data accessible to other Users and/or third parties;
legal obligations, i.e., to comply with obligations imposed by law, an authority, a Regulation or European legislation;
use of tracking pixels in email communications: the Joint Controllers use tracking pixels in e-mails – which are sent to the Users for the newsletter purpose as referred to in the above paragraph – to carry out individual measurement and analysis of the open rate of the e-mails sent to the Users. The information collected via tracking pixels will be used, more specifically, to evaluate and improve the performance of newsletter communications on the basis of observed behaviour (by changing the subject line of messages in the event of a low open rate or by improving their relevance, readability or appeal; by adjusting the frequency or ceasing to send messages based on the recipient’s expressed interest in the messages received, etc.).

The provision of personal data for the above processing purposes is optional but necessary, since failure to provide such data will make it impossible for the User to receive the newsletter e-mails from the Joint Controllers.

The Users may easily oppose further sending of promotional communications by clicking on the appropriate link in each e-mail. Once the request has been made, the Joint Controllers will send the User an e-mail message to confirm that what the User has requested has been carried out.

The Joint Controllers inform that, following the exercise of the right to object to the sending of promotional communications by e-mail, it is possible that, for technical and operational reasons (i.e., the formation of contact lists already completed shortly before the receipt by the Joint Controllers of the request for objection) the Users will continue to receive some further promotional messages. If you continue to receive promotional messages after 24 hours of exercising your right to object, please report the problem to the Joint Controllers using the contact details set out in “How to contact us?” paragraph.

Furthermore, it is specified that Users who have given consent to the processing of their personal data for newsletter purposes referred to in the paragraph above (consent which also includes the use of tracking pixels, which the Joint Controllers include in such communications) may, at any time, withdraw the choices made, including on a granular basis. In other words, Users may: i) choose to withdraw the single consent given, thereby preventing the future receipt of further communications for newsletter purpose; or ii) choose to withdraw consent only partially, with regard solely to the receipt of tracking pixels within such communications, via the “Manage your preferences” link included in each newsletter e-mail, which leads to a page where Users can turn off tracking pixels while continuing to receive the newsletter.

Legal basis for processing

Processing of User’s request: the legal basis consists in art. 6, paragraph 1, lett. a) of the Regulation, namely, the provision by the data subject of consent to the processing of his/her personal data for one or more specific purposes. For this reason, the Joint Controllers asks the User to provide a specific free and optional consent, in order to pursue such processing purpose.

Legal obligations: the legal basis consists of art. 6, paragraph 1, lett. c) of the Regulation, as the processing is necessary for compliance with a legal obligation to which the Joint Controllers are subject.

Use of tracking pixels in email communications: the legal basis for the purposes indicated herein is identified in the collection of consent pursuant to Article 122, par. 1 of the Privacy Code. Based on the indication provided by the Italian Data Protection Authority (Garante per la protezione dei dati personali), it is considered that the possible provision by the Users of the specific consent requested for the pursuit of the newsletter purpose referred to in the previous paragraphs also includes consent to receipt of the tracking pixels included therein.

Processing methods and data retention period

The Joint Controllers will process the personal data of Users using manual and IT tools, with logic strictly related to the purposes themselves and, in any case, in order to guarantee the security and confidentiality of the data.

Regarding the data retention period:

Processing of User’s request (newsletter): Users’ personal data will be processed for the purpose of sending the newsletter for as long as the Joint Controllers continue to provide the newsletter service to Users. The Users may withdraw their consent and unsubscribe from the newsletter at any time. In such case, their personal data will no longer be processed for newsletter purpose.
Legal obligations: Users’ personal data will be kept for the time strictly necessary to fulfil such purpose, or in any case as long as necessary to protect the interests of both the Users and the Joint Controllers in civil proceedings.
Use of tracking pixels in email communications: personal data collected via tracking pixels used by the Joint Controllers in e-mails, subject to Users’ prior consent for newsletter purpose (and without prejudice to any granular withdrawal made by the Users), will be processed for 24 months from the date the Users first open the e-mails.

In any case, this is without prejudice to possible retention periods provided for by Applicable Law.

Transmission and dissemination of data

The User’s personal data may be transferred to third countries located outside the European Union that offer an adequate level of data protection, such as to the territory of Switzerland. In this case, the Joint Controllers will ensure that the transfer takes place in accordance with the adequacy decision adopted by the European Commission on the basis of Article 45 of Regulation. The effect of that decision is that personal data may be transferred from the EU (and Norway, Liechtenstein and Iceland) to that third country without the need for additional safeguards. In other words, transfers to that country will be treated as data transfers within the EU.

In the absence of an adequacy decision, the User’s personal data may be transferred pursuant to Article 46 (Transfer subject to adequate guarantees) of the Regulation.

The personal data of the Users may be disclosed to the employees and/or collaborators of the Joint Controllers in charge of managing the newsletter’s service and the Users’ requests. These subjects, who have been instructed to do so by the Joint Controllers pursuant to Article 29 of the Regulation, will process the User’s data exclusively for the purposes indicated in this policy and in compliance with the provisions of the Applicable Law.

The personal data of the Users may also be disclosed to third parties who may process personal data on behalf of the Joint Controllers as “Data Processors” pursuant to Article 28 of the Regulation, such as, for example, IT and logistic service providers functional to the operation of the mailing list, suppliers of outsourcing or cloud computing services, professionals and consultants.

Users have the right to obtain a list of any data processors appointed by the Joint Controllers, by making a request in the manner indicated in “How to contact us?” paragraph.

Rights of the data subjects

Users may exercise their rights granted by the Applicable Law by contacting the Joint Controllers by sending an e-mail to: privacy@yeldo.com

The Users may also contact the Data Protection Officer (DPO) appointed by the Joint Controllers. The contact details of the DPO are: Shibumi S.r.l., in the person of Lapo Curini Galletti, email: dpo@yeldo.com.

Pursuant to the Applicable Law, Users have:

the right to withdraw consent at any time, if the processing is based on their consent, without this affecting the lawfulness of processing based on consent prior to withdrawal. Users may also withdraw their consent on a granular basis and, in particular, continue to receive the newsletter without the Joint Controllers using tracking pixels;
the right of access to personal data;
(where applicable) the right to data portability (the right to receive all personal data concerning them in a structured, commonly used and machine-readable format), the right to restriction of processing of personal data, the right to rectification and the right to erasure ("right to be forgotten");
the right to object:
- in whole or in part, for legitimate reasons to the processing of personal data concerning them, even if relevant to the purpose of collection;
- in whole or in part, to the processing of personal data concerning them for the purpose of sending advertising or direct sales material or for carrying out market research or commercial communication;
if they consider that the processing of their personal data is in breach of the Regulation, the right to lodge a complaint with a supervisory authority (in the Member State in which they have their habitual residence, in the Member State in which they work or in the Member State in which the alleged breach has occurred). The Italian Supervisory Authority is the Garante per la protezione dei dati personali, located in Piazza Venezia n. 11, 00187 - Rome (https://www.garanteprivacy.it/ ).

The Joint Controllers are not responsible for updating all links that can be viewed in this cookie policy, therefore whenever a link is not functional and/or updated, Users acknowledge and accept that they must always refer to the document and/or section of the websites referred to such link.