Privacy Policy

Data Controller

The Data Controller for personal data collected through the Site is: TLB Italy S.r.l., with registered office at Via Appia Pignatelli, 450, 00178 Rome (RM), VAT IT17245551001 ("Data Controller"), email: [email protected].

Processing methods

We attach the utmost importance to Users' right to privacy and the protection of personal data, which will be processed lawfully. Personal Data provided or acquired will be processed in accordance with the principles of fairness, lawfulness, transparency and confidentiality, with appropriate security measures to prevent unauthorised access, disclosure, modification or destruction.

Processing is carried out using IT and/or telematic tools, with organisational methods and logic strictly related to the stated purposes.

Personal data processed

When the User visits the Site, contacts us (by email, phone, post, etc.), subscribes to the newsletter or places an order, we process some of their personal data, either directly or through third parties.

Categories of personal data processed:

Identifying, contact and access data: name and surname, email address, shipping address, phone number, account login credentials, and any other Personal Data voluntarily provided by the User.

Purchase data: data relating to purchases made.

Browsing data: connection data, IP addresses, domain names and other parameters relating to the browser and operating system used.

Usage data: information generated when visiting the Site or making purchases: log data, registration data, interaction and transaction processes, performance indicators, browsing flows and feature usage.

Billing and payment data: VAT number where applicable, tax code, address.

Purposes of processing and legal basis

The Controller will process Users' Personal Data for the conduct of its business and commercial activities, for the specific purposes indicated below.

1. Contract-related purposes and legal obligations

1.1 Browsing the Site; 1.2 Account registration and management; 1.3 Activities necessary to conclude and perform the contract for the purchase of lighting products sold on the Site; 1.4 Order processing; 1.5 Customer care and responses to requests, complaints and reports; 1.6 Management of requests via remote communication tools; 1.7 Compliance with legal, regulatory and EU obligations; 1.8 Administrative, accounting and tax activities; 1.9 Responses to requests to exercise rights under the contract, applicable law or GDPR.

Legal basis: performance of pre-contractual and contractual obligations (Art. 6.1.b GDPR) or compliance with legal obligations (Art. 6.1.c GDPR). Except for optional account registration data, processing is necessary to conclude and perform contracts via the Site. Failure to provide data will prevent the User from concluding a contract and/or receiving responses to requests.

2. Analytics, statistics and other non-consent-based purposes

2.1 Statistical analysis of Site usage, browsing and product searches to improve the Site and product offering; 2.2 Protection of the Controller's contractual rights and prevention/repression of fraudulent or harmful actions; 2.3 Reminder to Users who started checkout that they added a lighting product to their cart (legitimate interest, Art. 6.1.f GDPR; transactional emails such as abandoned cart).

3. Direct marketing and profiling

3.1 With User consent, commercial emails with updates, news, offers, promotions and market research, including via automated tools such as email and newsletters; 3.2 With User consent, processing for profiling, retargeting and personalised commercial communications based on the User's profile, including automated decision-making.

Legal basis: User consent (Art. 6.1.a GDPR). Provision of data is optional. Refusal, withdrawal or objection will not affect the User's ability to purchase on the Site.

4. Soft-spam

Commercial communications to the email address provided during purchase to offer direct sale of similar products, based on Art. 130, paragraph 4 of the Italian Privacy Code (Legislative Decree 196/2003), provided the User does not object initially or in subsequent communications.

Changing choices and withdrawing consent

Users may withdraw consent and/or object to processing for generic marketing and profiling at any time via the methods indicated in the "Data Subject Rights" section.

Processing based on consent before withdrawal remains lawful. After withdrawal/objection for marketing, data will no longer be processed for that purpose unless another legal basis applies (contract performance, legal obligation, legitimate interest).

Retention period

Data will be processed for the time necessary to achieve the purposes for which it was collected. Specific retention periods apply per purpose: contract data for the time strictly necessary; tax/accounting/legal data until statutory deadlines; legitimate interest data until the interest is satisfied (up to 10 years for defence in disputes); marketing/profiling data for up to 12 months from consent or last contact. After retention periods, Personal Data will be deleted.

Communication and disclosure of data

In addition to the Controller, the following may have access to data: persons involved in organising the Site and company (tax consultant, webmaster, marketing consultant, IT support, software development); third parties processing data on behalf of the Controller (payment services, legal, accountants, system administrators, logistics, newsletter services); public or private entities with legal access; potential buyers of the company or entities resulting from mergers.

Recipients may act as processors, sub-processors or independent controllers. Users may request the updated list of processors under Art. 28 GDPR.

Place of processing and transfers abroad

Processing takes place mainly in Italy and EU countries. Some third-party tools may process data outside the EEA. Transfers may occur via external tools (newsletter, remarketing, advertising, social buttons, video). Where transfers to third countries are necessary, the Controller ensures adequate protection under Art. 45 GDPR or standard contractual clauses under Art. 46.2 GDPR.

Cookies

This Site uses cookies — small text files installed on users' devices to improve browsing, personalise content and ads, provide social features and analyse traffic. See the Cookie Policy for details.

Personal Data processing tools

Newsletter

Mailchimp (Intuit Inc.) — email address management and sending service. Processing location: UNITED STATES. Users may unsubscribe via the link in each commercial communication.

Social network buttons

Facebook and Instagram (Meta Platforms Ireland Limited) — interaction with social networks. Personal Data collected: Cookies, Usage data. Processing location: IRELAND – UNITED STATES.

Payment management

NEXI (Nexi S.p.A.), PayPal (Paypal Europe S.a.r.l.), Apple Pay (Apple Payments Inc.), Google Pay (Google Ireland Limited) — online payment services. See each provider's privacy policy for details.

Statistics

Google Analytics (Google Ireland Limited) — traffic analysis with IP anonymisation enabled. Opt-out: https://tools.google.com/dlpage/gaoptout?hl=en. Processing location: IRELAND and in some cases UNITED STATES.

Facebook Pixel (Meta Platforms Ireland Limited) — conversion tracking. Processing location: Ireland and in some cases UNITED STATES.

Remarketing

Services enabling advertising based on past Site usage via Usage Data tracking and Cookies. This Site uses Facebook Pixel.

Data Subject Rights

Data subjects may exercise the rights under Arts. 7 and 15-22 of the Regulation: access, rectification, erasure, restriction, portability, objection, and withdrawal of consent.

Requests may be sent to the Controller at [email protected]. Data subjects may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, http://www.garanteprivacy.it/).

Changes to this Privacy Policy

The Controller reserves the right to modify this Privacy Policy at any time by publishing updates on this page. Please check this page regularly, referring to the last update date at the bottom.

If Users do not accept changes, they must stop using the Site and may request deletion of their Personal Data. Previous versions apply to data collected before changes.

Privacy Policy last updated: March 2024.