General notice

General notice on the processing of personal data

of the website and e-commerce
pursuant to Articles 13 and 14 of Regulation (EU) 2016/679

Index

1. DATA CONTROLLER
2. SCOPE OF THIS NOTICE
3. CATEGORIES OF PERSONAL DATA PROCESSED
4. SOURCE OF THE DATA
5. PURPOSES AND LEGAL BASES OF PROCESSING
6. MANDATORY OR OPTIONAL NATURE OF PROVIDING DATA
7. LEGAL AGE AND PURCHASE OF ALCOHOLIC PRODUCTS
8. ACCOUNTS, ORDERS, PAYMENTS AND SHIPPING
9. NEWSLETTER, WHATSAPP AND COMMERCIAL COMMUNICATIONS
10. CRM, COMMERCIAL CLASSIFICATIONS AND AUTOMATED DECISIONS
11. COOKIES, ANALYTICS AND EXTERNAL SERVICES
12. PROCESSING METHODS AND SECURITY
13. RECIPIENTS OF THE DATA
14. TRANSFERS TO NON-EEA COUNTRIES
15. RETENTION PERIODS
16. RIGHTS OF THE DATA SUBJECT
17. RIGHT TO LODGE A COMPLAINT
18. CHANGES TO THIS NOTICE

1. DATA CONTROLLER

The Controller of the personal data processed through the jrose.it website, the e-commerce and the public services described in this Notice is:

Affreschi & Affreschi S.r.l.

Registered office: Zona P.I.P., Lotto 9, 73027 Minervino di Lecce (LE), Italy

VAT no. and tax code: IT04779110750

Digital domicile (PEC): affreschisrls@pec.it

Dedicated privacy email: privacy@jrose.it

J.Rose is a trademark licensed to and managed by Affreschi & Affreschi S.r.l. In this document, any reference to “J.Rose” therefore means Affreschi & Affreschi S.r.l. as Data Controller.

The Controller determines the purposes and means of the processing covered by this Notice. Parties that process data on behalf of the Controller are appointed, where necessary, as Processors under Article 28 GDPR.

1.1 Data Protection Officer

Affreschi & Affreschi S.r.l. has not appointed a Data Protection Officer (DPO). For information or to exercise the rights provided by the GDPR you can contact the Controller directly at privacy@jrose.it.

2. SCOPE OF THIS NOTICE

This Notice governs the processing of personal data carried out through:

• the corporate website jrose.it and its public pages;
• the J.Rose e-commerce, purchases made as a registered user or as a guest, and the personal e-commerce account;
• the public contact, support and information request forms;
• the first-contact forms intended for professional customers, distributors and other commercial operators;
• the newsletter and promotional communications by email, WhatsApp and operator-assisted calls;
• support relating to the site, orders, payments, shipments, returns and refunds;
• analytics, campaign measurement and online advertising activities, within the limits of the preferences expressed through the cookie management system.

This Notice does not govern the processing relating to:

• J.Rose Card, J.Rose membership, J.Rose app, Apple Wallet, Google Wallet, push notifications, geolocation and related reserved features;
• codes, content and reserved initiatives that involve independent registration or participation flows;
• specialist processing connected with Limited Editions, such as the authenticity of specimens, NFC chips for authentication, digital passports, blockchain and transfers of digital or registered ownership;
• the “Message in a JR Bottle” service, including activation, OTP verification, NFC Tag, Digital Page, text, video, access, deletion and moderation;
• participation in reserved events where dedicated data collection is provided for;
• ongoing professional relationships with customers, distributors, agents, suppliers and partners;
• employees, candidates, collaborators and other persons for whom a specific notice is provided.

For such services and relationships, specific notices are provided in the relevant environments, forms or procedures. In case of overlap, the specific notice prevails for the processing proper to the dedicated service, while this Notice continues to apply to the ordinary activities of the site and the e-commerce.

When a professional request sent through the site gives rise to an ongoing relationship, the subsequent processing is also governed by the notice intended for the professional customers, distributors, agents, suppliers or partners concerned.

3. CATEGORIES OF PERSONAL DATA PROCESSED

3.1 Identification and contact data

• first name and surname;
• email address;
• telephone number;
• country of residence or shipping;
• billing address and shipping address.

3.2 E-commerce account data

• email address used to log in;
• authentication credentials managed in protected form;
• information on creation, modification, recovery and closure of the account;
• date and time of the main operations;
• history of orders associated with the account.

Passwords are not made available in clear text to J.Rose staff. Users must keep their credentials safe and promptly report any unrecognised access.

3.3 Tax and professional data

For consumers, the tax code and the data necessary for tax documentation may be processed. For professional customers or legal entities, the company name, VAT number, tax code, registered office, PEC, SDI recipient code, contact person’s details, job title and professional contact details may also be processed.

3.4 Purchase data

• products, quantities, amounts and discounts applied;
• order date, number and status;
• delivery method;
• returns, refunds, complaints and disputes;
• notes voluntarily entered at checkout.

3.5 Payment data

• selected payment method;
• payment status, amount, date and time;
• transaction identifier;
• summary information communicated by the payment service provider.

J.Rose does not acquire or store full payment card details. Such data is entered and processed directly by the provider chosen by the user in accordance with its own notice.

3.6 Data of a recipient other than the buyer

When the product is shipped to a person other than the buyer, the following may be processed: first name and surname, delivery address, any telephone number or email necessary for delivery and any gift message entered by the buyer.

3.7 Age verification data

For Italian buyers, the tax code, also collected for tax purposes, may be used for a preliminary consistency check of the age requirement. The outcome of the check, the date, the method used and the elements strictly necessary to handle negative, ambiguous or inconsistent results may also be processed.

When further verification is necessary, J.Rose may request additional information or use a qualified supplier. Any identity document is not retained beyond the time strictly necessary for verification, except for legal obligations or disputes.

For foreign buyers, a declaration regarding the minimum age required in the destination country and, where necessary, the outcome of further verification may be collected.

3.8 Communications and support data

• content of requests sent by form, email, telephone or WhatsApp;
• correspondence relating to orders, shipments, returns, refunds and complaints;
• information communicated during support;
• any attachments sent spontaneously by the data subject.

3.9 Marketing data and email tracking

• authorised contact details and promotional channels;
• date, time, source, text and status of consent;
• changes of preferences and withdrawal;
• campaigns sent and their technical outcome;
• where permitted, clicks and other voluntary events of interaction with links in emails;
• any technical data associated with the events, such as IP address, date and time, browser, device and approximate location derived technically by the supplier.

Individual click tracking is used only when the data subject has been informed and has given the required consent. J.Rose keeps individual tracking of opens disabled and does not insert pixels intended to detect them. Where technically possible, click identifiers are pseudonymised and separated from the email address.

3.10 Commercial management data

• history of purchases and requests;
• quotes and contractual documents;
• notes entered by authorised staff;
• frequency, value and categories of purchases;
• internal commercial classifications made manually.

3.11 Technical data

• IP address;
• browser, operating system and device type;
• connection and session data;
• security, access and operation logs;
• information necessary for preventing abuse, fraud and technical errors.

3.12 Cookies and equivalent tools

The site may use technical cookies, preference cookies, analytics tools, advertising identifiers, conversion measurement tools and equivalent technologies. The categories, durations and suppliers actually active are indicated in the “Cookie and Tracking Policy of the J.Rose Digital Ecosystem” and in the preferences panel.

3.13 Special categories of data

J.Rose does not intentionally request data belonging to the special categories under Article 9 GDPR, such as health data, biometric data, or data relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sex life or sexual orientation.

Users must not enter such data in free-text fields, order notes, gift messages or support requests. Should such data be communicated spontaneously and not be necessary, J.Rose limits its access and use and deletes it as soon as reasonably possible, without prejudice to legal obligations or the protection of a right.

4. SOURCE OF THE DATA

4.1 Data provided directly by the data subject

Data is collected when the user browses areas that require information, creates or manages an account, makes a purchase, fills in a form, contacts support, subscribes to the newsletter, gives or withdraws consent, communicates by email, telephone or WhatsApp, or changes their preferences.

4.2 Data collected automatically

During use of the site, technical data may be generated by servers, hosting systems, logs, security tools, cookies and equivalent technologies. Tools that are not strictly necessary are activated only in compliance with the preferences expressed by the user.

4.3 Recipient data provided by the buyer

When the buyer names another person as the recipient of the order, J.Rose receives the related data from the buyer. Such data is used to prepare the shipment, carry out delivery, handle logistics problems and fulfil the obligations connected with the order.

The buyer must provide correct, relevant data limited to what is necessary and, where possible, bring this Notice to the recipient’s attention. J.Rose makes the Notice accessible on the site and, depending on the actual delivery flow, by means of a link in the first direct communication to the recipient, in the order documentation, on a medium accompanying the product or in another appropriate manner.

Recipient data is not used for promotional purposes, unless the recipient independently gives their consent through an official J.Rose channel.

4.4 Data derived or processed internally

J.Rose may derive the outcome of the age-requirement check, information on the frequency and value of purchases, indicators of commercial interest and internal classifications assigned by authorised staff. These processing operations do not automatically determine prices, contractual conditions, definitive refusal of a purchase or other legal or similarly significant effects.

5. PURPOSES AND LEGAL BASES OF PROCESSING

5.1 Browsing, operation and security of the site

Technical data is processed to make the site and the e-commerce available, manage sessions, keep the cart, diagnose errors, protect the systems, prevent unauthorised access and ensure operational continuity.

Legal basis: performance of measures requested by the user and the Controller’s legitimate interest in the security and proper functioning of the systems, Article 6(1)(b) and (f) GDPR.

5.2 Creation and management of the account

Data is processed to create and authenticate the account, allow consultation of the order history, update data, recover credentials, handle requests and close the account.

Legal basis: performance of the contract or of pre-contractual measures requested by the data subject, Article 6(1)(b) GDPR.

5.3 Verification of the age requirement

Data is processed to prevent the sale and delivery of alcoholic products to persons who have not reached the applicable minimum age, carry out consistency checks and handle further verification.

Legal basis: compliance with legal obligations, performance of the measures necessary for the conclusion and performance of the purchase and legitimate interest in preventing abuse, Article 6(1)(b), (c) and (f) GDPR.

5.4 Orders and contractual relationship

Data is processed to receive and confirm the order, check availability, prepare the products, manage any customisation provided at checkout, communicate with the buyer, carry out delivery, and handle returns, refunds, warranties and complaints.

Legal basis: performance of the contract and pre-contractual measures requested by the data subject, Article 6(1)(b) GDPR.

5.5 Payments

Data is processed to link the payment to the order, verify the outcome of the transaction, and handle refunds, disputes and anti-fraud activities connected with the payment.

Legal basis: performance of the contract, compliance with legal obligations and legitimate interest in preventing fraud, Article 6(1)(b), (c) and (f) GDPR.

5.6 Shipments and third-party recipients

Data is processed to prepare the shipment, communicate the necessary information to the carrier, provide tracking, contact the recipient where necessary and handle delivery anomalies.

Legal basis: performance of the contract concluded with the buyer and legitimate interest in correctly delivering to the named recipient, Article 6(1)(b) and (f) GDPR.

5.7 Tax, accounting, administrative and regulatory obligations

Data is processed to issue and retain tax documents, keep accounts, fulfil administrative, customs, product and public-safety obligations and respond to lawful requests from the authorities.

Legal basis: compliance with legal obligations, Article 6(1)(c) GDPR.

5.8 Contacts and support

Data is processed to respond to requests, provide support, handle complaints and reconstruct the communications relevant to an order or an ongoing relationship.

Legal basis: performance of pre-contractual or contractual measures, compliance with legal obligations and legitimate interest in handling requests, Article 6(1)(b), (c) and (f) GDPR.

5.9 First professional contact

Data entered in the forms intended for professional operators is processed to assess the request, contact the person concerned and prepare any proposals. If an ongoing relationship arises, the applicable specific notice is provided or referred to.

Legal basis: pre-contractual measures requested by the data subject and legitimate interest in managing professional commercial relationships, Article 6(1)(b) and (f) GDPR.

5.10 Direct marketing

Subject to consent, J.Rose may send promotional communications relating to products, initiatives and events through the authorised channels. Purchasing or creating an account does not automatically entail subscription to promotional communications.

Legal basis: the data subject’s consent, Article 6(1)(a) GDPR and, for electronic communications, applicable national law.

5.11 Detection of clicks in emails

When the relevant consent is active, J.Rose may detect voluntary clicks on links and the strictly connected technical events, in order to measure interest in the content and assess the effectiveness of campaigns. Individual tracking of opens is disabled. Clicks are not used for automated decisions producing legal or similarly significant effects.

Legal basis: the data subject’s consent, Article 6(1)(a) GDPR and, where applicable, Article 122 of the Italian Personal Data Protection Code.

5.12 CRM and commercial organisation

Data is processed to keep records up to date, link orders and requests, prepare quotes, organise commercial work, recognise active or inactive relationships and assign manual internal classifications. Such information is used to personalise promotional communications only where the required consent exists.

Legal basis: performance of the contractual relationship and the Controller’s legitimate interest in organising its business, Article 6(1)(b) and (f) GDPR.

5.13 Protection of rights, fraud prevention and order checks

Data may be processed to establish, exercise or defend a right, prevent fraud and abuse, reconstruct anomalies, handle disputes and carry out manual checks of consistency, security and regularity of orders before fulfilment.

Legal basis: legal obligation and legitimate interest in the protection of rights and business security, Article 6(1)(c) and (f) GDPR.

5.14 Handling of privacy requests

Data is processed to identify the requester, verify the right exercised, locate the data present in the systems, provide a response and document the proper handling of the request.

Legal basis: compliance with legal obligations, Article 6(1)(c) GDPR.

6. MANDATORY OR OPTIONAL NATURE OF PROVIDING DATA

Providing the data marked as mandatory in the forms is necessary, depending on the case, to create the account, complete a purchase, verify the age requirement, process the payment, issue tax documents, ship the order or handle a request.

Failure to provide it may make it impossible to create the account, conclude or perform the purchase, carry out delivery, issue the requested documentation or provide support.

Data marked as optional, including order notes and the gift message, is left to the user’s choice and must be relevant and not excessive.

Consent to promotional communications and to email tracking is optional, separate from acknowledgement of the Notice and not necessary to purchase, create an account or receive support. Withdrawal does not affect the lawfulness of processing carried out before.

Disabling email tracking alone does not amount to withdrawing consent to receive promotional emails: subsequent communications are sent without individual markers.

7. LEGAL AGE AND PURCHASE OF ALCOHOLIC PRODUCTS

The J.Rose site and e-commerce are intended for persons who have reached the minimum age required to purchase alcoholic beverages. Initial access may require a declaration of legal age by means of a dedicated notice. This declaration is preliminary and does not replace any checks required for purchase or delivery.

For Italian buyers, the tax code, also collected for tax purposes, may be used for a preliminary consistency check. The automatic result does not by itself lead to definitive refusal of the purchase.

In the event of a negative, ambiguous or inconsistent result, J.Rose may temporarily suspend checkout or fulfilment of the order and request further verification carried out by authorised staff or a qualified supplier. The data subject may request human intervention, submit clarifications and challenge the outcome of the check.

For foreign buyers, a declaration regarding the minimum age applicable in the destination country and, where necessary, further verification consistent with the law and the actual delivery flow may be requested.

Where technically possible, J.Rose retains only the outcome of the check, the date and the method used. Any copy of a document is deleted as soon as the verification is complete, except for legal obligations, disputes or the need to protect rights.

Should J.Rose become aware of an account or an order made through untruthful declarations about age, it may suspend or close the account, cancel the order where permitted and restrict or delete data no longer necessary, without prejudice to legal obligations and the documentation of the event.

8. ACCOUNTS, ORDERS, PAYMENTS AND SHIPPING

8.1 Account and guest checkout

Users may purchase by creating an account or, where available, using guest checkout. The e-commerce account is distinct from the private areas relating to membership and J.Rose’s other specialist services.

Creating the account does not automatically entail enrolment in membership, the newsletter or promotional communications.

8.2 Payments

Payments are handled using the methods shown at checkout. The selected provider directly receives the data necessary for the transaction and issues its own notice. J.Rose receives only the information necessary to know the outcome of the transaction and link it to the order.

The payment provider may act as an independent Controller for its own purposes, such as fraud prevention, financial and regulatory obligations, network management, identity verification and disputes.

8.3 Shipping

To deliver the order, the necessary data is communicated to the carrier or logistics operator used. The appointed party may use the data to organise transport, provide tracking, contact the recipient and fulfil its own obligations. The carrier actually used appears in the confirmation or shipping communications.

8.4 Recipient other than the buyer

A buyer who enters another person’s data must provide correct information limited to delivery, avoid gift messages containing confidential or excessive data and, where possible, bring this Notice to the recipient’s attention.

J.Rose makes a link to the updated version of the Notice available to the recipient through the methods actually used in the delivery flow, such as tracking communications, order documentation, material accompanying the product or any digital tools actually applied.

9. NEWSLETTER, WHATSAPP AND COMMERCIAL COMMUNICATIONS

9.1 Collection of consent

Consent may be requested in the footer, in a form or popup, during registration, at checkout or at other relevant points. The box is separate from the terms of sale and from acknowledgement of the Notice, is not preselected and does not condition purchase or registration.

The promotional channels actually available are indicated in the consent form. Users may authorise only the channels they want among those offered and may later change their choices.

9.2 Information on click tracking

When click measurement is not activated or is disabled, J.Rose does not individually detect clicks through identifiers inserted in subsequent emails. Opens in any case remain free of individual tracking.

9.3 Proof of choices

J.Rose retains the information necessary to demonstrate the user’s choice, such as contact, source, date and time, text presented, categories accepted or refused, changes and withdrawal. Subscription confirmation mechanisms suitable for documenting the origin of the request may be used.

9.4 Communications to customers

Purchasing a product does not entail automatic enrolment in marketing. In the absence of consent, the customer receives only necessary communications relating to account, order, payment, shipping, support, returns, refunds, security and legal obligations.

J.Rose does not use the email address acquired during purchase to send promotions in the absence of the required consent.

9.5 WhatsApp

Promotional communications via WhatsApp are sent only to those who have authorised that channel. They are sent individually or by tools configured so as not to allow recipients to see the contact details or personal data of other users.

The WhatsApp button on the site is a link to the external service. J.Rose does not receive the content of the conversation until the user decides to send a message; the service provider may process technical data in accordance with its own notice.

9.6 Operator-assisted calls

Promotional calls are made only to those who have authorised that channel. Calls strictly necessary for the order or for handling a request are not promotional in nature.

9.7 Click analysis

When consent to measurement is active, J.Rose may use voluntary clicks and the strictly connected technical events to understand interest in specific content and manually organise commercial activities. Opens are not detected individually.

9.8 Withdrawal, disabling click measurement and objection

The data subject may withdraw consent for all channels or for only one of them, and may disable only click measurement while continuing, if desired, to receive emails.

Withdrawal or change may be made through the tools in the communications, the preferences panel, WhatsApp, the telephone operator or by writing to privacy@jrose.it. After withdrawal, the contact is excluded from the active lists concerned. J.Rose may keep a minimal record of the objection to avoid accidental re-enrolment.

10. CRM, COMMERCIAL CLASSIFICATIONS AND AUTOMATED DECISIONS

J.Rose uses management, accounting and CRM tools to administer records, orders, warehouse, quotes, commercial activities, statistics, shipments and administrative or customs obligations.

Authorised staff may manually assign internal classifications relating, for example, to the currency of the relationship, frequency and value of purchases, product categories requested or interest shown. These classifications support internal organisation and do not automatically grant prices, discounts, payment terms, the ability to purchase or other rights.

The classifications are not used to personalise promotional communications in the absence of any required consent. Within the scope governed by this Notice, J.Rose does not carry out automated creditworthiness assessments or decisions based solely on automated processing that produce legal or similarly significant effects.

The preliminary age check may use automatic tools, but a negative, ambiguous or inconsistent outcome does not by itself lead to definitive refusal of the purchase. The data subject may obtain human intervention in accordance with Article 7.

11. COOKIES, ANALYTICS AND EXTERNAL SERVICES

11.1 Strictly necessary cookies and tools

Strictly necessary cookies and tools may be used to display the site, maintain the session, manage the cart, authenticate the user, store technical preferences, ensure security and record cookie choices. They do not require consent when they are indispensable to the service requested.

11.2 Non-essential tools

Analytics tools that are not strictly necessary, conversion measurement, remarketing, advertising personalisation, behavioural advertising and social integrations are activated only with prior consent, where required.

Technologies that are not strictly necessary are blocked before consent by means of Iubenda Privacy Controls and Cookie Solution. In the panel, the tools are classified under the five purposes Necessary, Functionality, Experience, Measurement and Marketing. Optional purposes are disabled by default; refusal, selection and withdrawal are recorded through the Cookie and Consent Preference Log. Active suppliers, durations and recipients are indicated in the “Cookie and Tracking Policy of the J.Rose Digital Ecosystem” and in the preferences panel.

Users may refuse non-essential tools as easily as they can accept them, select the available categories and later change their preferences using the permanent control on the site.

11.3 External content and links

The site may embed videos, social content, fonts, widgets and links to external services. Where necessary, such content is blocked until the user makes a choice. By opening an external link, the user enters an environment governed by the notice of the relevant provider.

12. PROCESSING METHODS AND SECURITY

Personal data is processed using IT and telematic tools and, where necessary, on paper, in accordance with the principles of lawfulness, fairness, transparency, minimisation, accuracy, storage limitation and integrity.

J.Rose adopts technical and organisational measures appropriate to the risk, reviewed in light of the evolution of systems and processing, including:

• protection of communications and sessions;
• access controls and differentiated authorisations;
• authentication measures for administrative access;
• updating and maintenance of systems;
• backups and recovery procedures;
• logging and monitoring of security events;
• procedures for handling incidents and data breaches;
• training and instructions for authorised staff;
• prompt revocation or modification of access no longer necessary.

Technical suppliers may access data only to the extent necessary to provide support, maintenance, security, backup, recovery and updates. In the event of a personal data breach, J.Rose assesses the risk, documents the incident, adopts corrective measures and makes the communications required by Articles 33 and 34 GDPR where the conditions are met.

13. RECIPIENTS OF THE DATA

Data may be communicated, to the extent necessary for the purposes described, to the following categories of recipients:

• providers of hosting, infrastructure, maintenance, development, email, backup, security and technical support;
• providers of the e-commerce platform and of the services necessary to manage the account and orders;
• providers of management, accounting, CRM, administrative, logistics and customs software;
• suppliers used for the newsletter, consent management and sending of communications;
• payment service providers and banking operators;
• carriers, forwarders and logistics operators;
• providers of analytics, advertising and external content, only within the limits of the preferences expressed;
• accountants, tax advisers, legal advisers, IT consultants, insurers and other appointed professionals;
• judicial, administrative, tax, customs or public-safety authorities in the cases provided by law.

Some recipients act as Processors under Article 28 GDPR; others, in particular payment providers, carriers, advertising platforms and authorities, may operate as independent Controllers for their own purposes. The updated list of Processors can be requested from privacy@jrose.it.

J.Rose does not sell personal data and does not transfer it to third parties for their own independent promotional activities.

14. TRANSFERS TO NON-EEA COUNTRIES

Some technology, advertising, payment or communication suppliers may process personal data outside the European Economic Area.

Transfer takes place, depending on the supplier and the destination country, on the basis of an adequacy decision of the European Commission, the EU-US Data Privacy Framework where applicable to a participating organisation, the Standard Contractual Clauses approved by the European Commission, supplementary technical, contractual and organisational measures or, only in the permitted cases, a derogation under Article 49 GDPR.

The data subject may request information on the safeguards applicable to the specific transfer by writing to privacy@jrose.it.

15. RETENTION PERIODS

Data is retained for the time necessary for the purposes for which it was collected. The following periods apply except for legal obligations, disputes, investigations, fraud, the exercise or defence of rights and requests from the authorities, which may justify further retention limited to the relevant data.

15.1 E-commerce account

The data necessary for the operation of the account is retained until deletion is requested. In the event of inactivity, the account may be deleted 5 years after the last login or purchase, preceded, where possible, by a notice. Order data and documents subject to independent periods are not deleted with the account.

15.2 Orders, invoices and tax documents

The data contained in orders, invoices, accounting records and tax-relevant documents is retained for 10 years, except for further periods provided by law or necessary in the event of a dispute.

15.3 Shipments and recipients other than the buyer

The recipient’s operational shipping data, including contact details and any gift message, is ordinarily retained for 24 months from delivery, except for complaints, disputes or the need for protection. If reported in tax, accounting or contractual documents subject to a longer period, it follows the period applicable to such documents.

15.4 Generic requests

Requests that do not give rise to a purchase or an ongoing relationship are retained for 12 months from the reply or the last communication.

15.5 Support, returns, refunds and complaints

Communications relating to support, returns, refunds and complaints are retained for 24 months from closure of the request, except for disputes or the need to protect rights.

15.6 CRM and ordinary commercial relationships

Records and ordinary commercial information are retained for 5 years from the last purchase or significant commercial contact. When an ongoing professional relationship arises, the periods indicated in the specific notice also apply.

15.7 Manual commercial classifications

Manual classifications are reviewed, updated or deleted after 24 months without significant interaction, unless still necessary for an ongoing relationship or for the protection of rights.

15.8 Newsletter and marketing

Data used for marketing is retained until consent is withdrawn or, in the absence of withdrawal, for a maximum of 24 months from the last active interaction. Active interactions include, by way of example, a voluntary click, a purchase, updating of preferences, a new request or a new confirmation of consent. Opens, which are not detected individually, do not renew the period.

15.9 Clicks and other voluntary interaction events

Historical data relating to clicks and strictly connected technical events is deleted or anonymised on withdrawal of the relevant consent and, in any case, at the end of the period applicable to marketing data. The minimal record necessary to document the choice or the exercise of a right remains unaffected. J.Rose does not keep an individual history of opens.

15.10 Proof of consent, withdrawal and exclusion list

The minimum information necessary to demonstrate consent, the change of preferences, withdrawal, objection and exclusion from campaigns is retained for 5 years from the last promotional communication or from withdrawal. During this period the contact on the exclusion list is not used to send promotions.

15.11 WhatsApp

WhatsApp conversations are ordinarily retained for 24 months from the last communication. They may be retained for longer when they concern an order, a contract, a complaint, a dispute or the protection of a right.

15.12 Age verification

The outcome, date and method of the check are retained for the time necessary to demonstrate the proper handling of the purchase and delivery, ordinarily for 24 months from delivery, except for legal obligations, disputes or connection with documents subject to a longer period. Data relating to checks not followed by a purchase is ordinarily deleted within 6 months. Any copies of documents are deleted as soon as the verification is complete and, as a rule, within 30 days, except for documented needs.

15.13 Technical and security logs

Technical logs are ordinarily retained for 12 months. The period may be extended up to 24 months in the presence of anomalies, unauthorised access attempts, fraud, incidents or the need for investigation.

15.14 Cookies and identifiers

Cookies and identifiers are retained for the periods indicated in the “Cookie and Tracking Policy of the J.Rose Digital Ecosystem” and in the preferences panel, consistently with the categories and suppliers actually active.

15.15 Privacy requests

Documentation relating to the exercise of rights is retained for 5 years from closure of the request, except for disputes.

15.16 Litigation

Data necessary for the handling of a dispute is retained for the entire duration of the dispute and subsequently for the period necessary to establish, exercise or defend rights.

15.17 Backups

Data deleted from the live systems may temporarily remain in backups until completion of the normal overwriting cycle, ordinarily within 30 days. Data in backups is not used for ordinary purposes and is recovered only for technical needs, security or operational continuity.

Once the applicable period has expired, data is deleted, anonymised or rendered unusable, except for legal obligations or the need to protect rights.

16. RIGHTS OF THE DATA SUBJECT

The data subject may exercise the rights provided by Articles 15–22 GDPR, within the limits and conditions established by law.

16.1 Access

To obtain confirmation of whether processing exists, receive the information required by law and obtain a copy of their personal data.

16.2 Rectification

To request correction of inaccurate data and completion of incomplete data.

16.3 Erasure

To request erasure in the cases provided by law. The right does not apply where retention is still necessary, among other things, to comply with a legal obligation, perform a contract, handle a dispute or establish, exercise or defend a right.

16.4 Restriction

To request temporary restriction of processing in the cases provided by Article 18 GDPR.

16.5 Portability

To receive, where applicable, the data provided by the data subject in a structured, commonly used and machine-readable format and to request its transmission to another Controller, where technically feasible. The right applies to automated processing based on consent or contract.

16.6 Objection

To object to processing based on legitimate interest. J.Rose ceases the processing unless it demonstrates compelling legitimate grounds that override, or the need to establish, exercise or defend a right. Objection to direct marketing is always upheld.

16.7 Withdrawal of consent

To withdraw at any time the consent given, without affecting the lawfulness of the processing carried out before withdrawal. Withdrawal may concern all channels, a single channel or only email tracking.

16.8 Human intervention

To request the intervention of authorised staff, express their point of view and challenge the outcome when a preliminary automatic age check produces a negative, ambiguous or inconsistent result. Within the scope of this Notice, J.Rose does not adopt other decisions based solely on automated processing that produce legal or similarly significant effects.

16.9 How to exercise rights

Requests may be sent to privacy@jrose.it or by PEC to affreschisrls@pec.it.

J.Rose may ask for confirmation from the email address associated with the account or for further information only when necessary to verify identity. An identity document is requested only where there is a reasonable doubt and when less invasive methods cannot be used.

A response is provided without undue delay and in any case within one month of the request. The period may be extended by a further two months where necessary, taking into account the complexity and number of requests; the data subject is informed of the extension and the reasons within the first month.

17. RIGHT TO LODGE A COMPLAINT

The data subject has the right to lodge a complaint with the competent supervisory authority, without prejudice to any other administrative or judicial remedy.

For Italy:

Garante per la protezione dei dati personali (Italian Data Protection Authority)

Piazza Venezia 11 – 00187 Rome

Email: protocollo@gpdp.it

PEC: protocollo@pec.gpdp.it

A data subject resident in another European Union Member State may contact the competent authority, in particular in the State of their habitual residence, place of work or place where the alleged infringement occurred.

18. CHANGES TO THIS NOTICE

J.Rose may update this Notice to adapt it to regulatory, organisational or technical changes, introduce or modify services, update suppliers and systems, correct inaccuracies or implement guidance from the authorities.

Each version shows the number and the date of the last update. Significant changes are communicated by a notice on the site and, where necessary, by direct communication to registered users.

When a change involves processing based on new consent, such processing is not started before the required consent is obtained.

The current version is the one published in the footer of jrose.it. Previous versions may be requested by writing to privacy@jrose.it.