Newsletter Privacy Policy

Dear User,
In accordance with current legislation on the protection of personal data, with particular reference to Article 13 of Regulation (EU) 679/2016 (hereinafter referred to as the Regulation or GDPR), as Data Controller, I hereby inform you that your personal data, collected exclusively for the purpose of sending promotional and commercial communications from the Company, will be processed in compliance with legal obligations and principles, ensuring full protection of your fundamental rights and freedoms, with particular regard to the principles applicable to the processing of personal data referred to in Article 5 of the Regulation.
The newsletter is distributed via e-mail to those who request to receive it by filling out the form on the Company website Complife Group – Global Testing & Compliance for Cosmetics and Healthcare

DATA CONTROLLER

The processing of your personal data is carried out by Complife Italia S.r.l. with registered office in via Guido Rossa, 1 – 20024 Garbagnate Milanese (MI), VAT Number 11093320155, e-mail info@complifegrioup.com, certified email complifeitalia@legalmail.it, as Data Controller pursuant to and for the purposes of the Regulation.

DATA PROTECTION OFFICER

The Data Controller has appointed a Data Protection Officer whom you may freely contact for any clarification or issue regarding your privacy at the following e-mail address: dpo@complifegroup.com, certified email address: dpo@pec.complifegroup.com

TYPE OF PERSONAL DATA PROCESSED

The personal data processed are as follows:

Identification and contact details (first and last name);
Contact details (email address);
Position held in the Company;
Type of area of interest.

PURPOSE OF PROCESSING, LEGAL BASIS, AND RETENTION PERIOD

Personal data is processed for purposes related to the subscription, management, and distribution of the newsletter. Specifically, the data will be processed for the following purposes:

Purpose of processing

Legal basis for processing

Data Retention Period

Compliance with the request to send

the newsletter and related

subscription to the mailing list

concerning informational and

promotional and communications

relating to the activities carried out

by the Data Controller, event and

trade shows and regulatory and

legislative updates

Consent

(art. 6, par. 1, lett. a) of the GDPR)

Personal data will be retained until
consent is withdrawn and, in any case, no
longer than 48 months from the date of
collection, given the primarily
informational and professional nature of
the communications and the multi-year
cycle of regulatory, technical, and
industry updates.
You may opt out at any time by clicking
the “Unsubscribe” button included in
every communication received to the
email address you provided.

To ascertain, exercise, or defend the

rights of the Data Controller in

extrajudicial and/or judicial

proceedings

The processing carried out is

necessary for the pursuit of

legitimate interests.

For the entire duration of the

dispute, until the time limits for

bringing appeals have expired.

For this type of processing, consent is deemed to have been given when the data subject submits the data contained in the online registration form.

LEGAL NATURE OF THE PROVISION OF PERSONAL DATA

The provision of your personal data is optional.
If you consent to receiving the newsletter, we remind you that you have the right to revoke your consent at any time, as easily as you previously gave it.

CATEGORIES OF DATA RECIPIENTS

For the purposes outlined above, the following parties may access your data:

the Data Controller’s employees, authorized data processors, who operate under the authority of the Data Controller and act on the basis of specific instructions provided regarding the purposes and methods of processing;
subjects who provide services instrumental to the purposes indicated in this policy, who are provided with adequate operating instructions and who are designated as Data Processors (for example, the company that manages the website and the company that offers mass mailing services).

The list of Data Processors is available upon request at the following addresses:

by email to the following address: dpo@complifegroup.com, dpo@pec.complifegroup.com
by mail to the adress: Via Guido Rossa, 1 – 20024, Garbagnate Milanese (MI).

METHOD OF PROCESSING

The processing of personal data ensures the integrity, confidentiality, and availability of the information. To this end, the Data Controller implements technical and organizational measures appropriate to the level of risk.
The data will be processed mainly by electronic means, with the possibility of residual paper processing.
The aforementioned information may be contained in records and documents processed by the Data Controller (or on its behalf) and stored in paper or electronic archives.

TRANSFER OF DATA ABROAD

The newsletter service is managed on the Mailchimp email marketing platform, owned by Intuit, a company based in the United States that adheres to the EU-US Data Privacy Framework (adequacy decision “Data Privacy Framework” approved by the European Commission on July 10, 2023). For further information, please consult Mailchimp’s privacy policies at the following address Global Privacy Statement | Intuit.

CANCELLATION OF THE SERVICE

To unsubscribe from the newsletter, click on the “Unsubscribe” button located in each email received at the email address provided.

RIGHTS OF DATA SUBJECTS

With regard to the processing of your personal data, you may exercise the following rights with respect to the Data Controller at any time:

RIGHT	DESCRIPTION
ACCESS (see Article 15 of the GDPR)	The right to obtain confirmation as to whether or not personal data concerning you is being processed, and to access such data and information regarding: the purposes of the processing, the categories of data processed, any recipients, any transfers and any appropriate safeguards, the retention period, the rights of the data subject, and the existence of automated decision-making. The Data Controller shall provide a copy of the personal data. If the request is made by electronic means, and unless otherwise specified, the information shall be provided in a commonly used electronic format.
RECTIFICATION (see Article 16 of the GDPR)	The right to correct inaccurate personal data and complete incomplete personal data.
ERASURE (see Article 17 of the GDPR)	The right to have personal data concerning the data subject erased if: the data is no longer necessary for the purposes for which it was collected, the data subject withdraws consent (and there is no other legal basis for the processing), the data subject objects to the processing on grounds relating to his or her particular situation (and there are no overriding legitimate grounds), the data subject objects to processing for direct marketing purposes, the personal data has been processed unlawfully, it must be erased to comply with a legal obligation, or it was collected in connection with the provision of information society services. This right does not apply if the processing is necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation, for the performance of a task carried out in the public interest or in the exercise of official authority, for reasons of public interest in the field of public health, for archiving purposes in the public interest, for scientific or historical research purposes, or for statistical purposes, for the establishment, the exercise or defense of a legal claim in court.
RESTRICTION (see Article 18 of the GDPR)	Right to request that the data be retained only if: the data subject has contested the accuracy of the data (for the period necessary to verify its accuracy), the processing is unlawful (but the data subject has requested restriction rather than erasure), the data are necessary for the data subject in legal proceedings, and, although the controller no longer needs them, the data subject has exercised the right to object (while the controller verifies the existence of legitimate and overriding grounds).
DATA PORTABILITY (see Article 20 of the GDPR)	Right to receive data in a structured format (only for automated processing).
OBJECT (see Article 21 of the GDPR)	The right to object to the processing of your personal data if (i) such processing is based on a public interest or a legitimate interest, and (ii) the data is processed for direct marketing purposes, including profiling.
WITHDRAWAL OF CONSENT (see Article 13, c.2, d) of the GDPR	The right to withdraw consent at any time, where consent serves as the legal basis for processing, without affecting the lawfulness of processing based on consent prior to its withdrawal.
COMPLAINT (see Artilcle 13, c.2, d) of the GDPR	The right to file a complaint with the Data Protection Authority regarding any alleged violation of the GDPR.

HOW TO EXERCISE YOUR RIGHTS

You may exercise your rights at any time by contacting the Data Protection Officer:

by e-mail to the address: dpo@complifegroup.com dpo@pec.complifegroup.com
by mail to the address: Via Guido Rossa 1, 20024, Garbagnate Milanese (MI).