Privacy policy

DATA CONTROLLER

The Data Controller is MySecretCase S.r.l., headquartered in Milan at Corso Colombo 7, 20144, VAT no. 06396080480, PEC: mysecretcasesrl@pec.it

By visiting this site, personal and/or corporate data relating to identified or identifiable individuals may be processed.

PLACE OF DATA PROCESSING

Processing related to the web services of this site takes place at the above address as well as on third-party servers owned by Shopify, located in the United States, and is handled only by authorized personnel, or by persons occasionally responsible for maintenance and administrative operations. Data provided may be disclosed to third parties in connection with services performed for the Controller; such parties will be appointed as data processors under Art. 28 of EU Regulation 2016/679.

TYPES OF DATA PROCESSED

Browsing data: The computer systems and software procedures used to operate this website acquire certain personal data during normal operation, the transmission of which is implicit in the use of internet communication protocols. This information is not collected to be linked to identified individuals, but by its nature could, through processing and association with data held by third parties, allow users to be identified. This category includes IP addresses or domain names of computers used by visitors, URI addresses of requested resources, the time of the request, the method used to submit the request to the server, the size of the file received in response, the numeric code indicating the status of the server's response (success, error, etc.), and other parameters relating to the user's operating system and computing environment. This data is used solely to derive anonymous statistical information about site usage and to verify correct functioning, and is deleted immediately after processing. The data may be used to establish liability in the event of hypothetical computer crimes against the site.

Data voluntarily provided by the user: the optional, explicit, and voluntary submission of personal data for contact requests/purchases (first name, last name, requests, email address, and other general data) to the addresses indicated on this site, as well as in forms, results in the subsequent collection of the user's data necessary to respond to requests, as well as any other personal data entered in the message or forms. Specific notices will be provided under each service offered.

Cookies: This section of the site sends visitors certain files commonly known as cookies. Cookies are used by the computer's browser exclusively to store session information for the website user. The use of cookies is an industry standard, and browsers store them in a dedicated folder. If you prefer not to receive cookies or wish to be informed beforehand, you can set your web browser accordingly. For more information on cookies (see cookie policy link).

OPTIONAL NATURE OF DATA PROVISION

Aside from what is specified for browsing data, the user is free to provide the personal data requested in request forms, private area registration, or otherwise indicated in contact channels. Failure to provide such data, in whole or in part, may make it impossible to obtain what was requested.

PROCESSING METHODS

Personal data is processed using IT tools for the time strictly necessary to achieve the purposes for which it was collected, and is compared with data already held by the Controller for carrying out activities or services. In case of discrepancy, the authorized person may contact the sender to verify the accuracy of the data or make any necessary corrections. Specific security measures are observed to prevent data loss, unlawful or improper use, and unauthorized access.

ADDITIONAL PROCESSING INFORMATION

Legal defense

The User's personal data may be used by the Controller for defense in legal proceedings or in preparatory stages prior to their potential initiation, arising from misuse of the site or related services by the User.
The User acknowledges that the Controller may be required to disclose data at the request of public authorities.

Specific notices

At the User's request, in addition to the information contained in this privacy policy, this Site may provide the User with additional and contextual information regarding specific services, or the collection and processing of Personal Data.

System logs and maintenance

For operational and maintenance needs, this Site and any third-party services it uses may collect system logs, i.e., files that record interactions and may also contain personal data, such as the User's IP address.

Retention period

Personal data will be retained in compliance with legal obligations and to the extent strictly necessary for the purposes of processing, in accordance with applicable regulations.

Data recipients

Personal data will not be disseminated. Personal data provided for the purchase and ordering of products may instead be disclosed to:

• parties to whom such disclosure must be made in order to comply with or enforce compliance with specific obligations under laws, regulations, and/or EU legislation;
• external individuals and/or entities that provide services instrumental to the Controller's activities (e.g., call centers, suppliers, consultants, companies, organizations, professional firms). These parties will act as data processors.

Transfer of data outside the EU

Data may transit or be hosted on servers owned by us or our partners, located outside the European Union. These servers may be located anywhere in the world, in countries whose laws may provide a different level of protection than ours. Nevertheless, we are committed to taking the necessary measures to maintain an adequate level of privacy and security. For example, we may require our subcontractors and partners to implement measures to ensure the level of protection required by applicable personal data regulations. We will take care to inform you whenever the server is located outside the European Union.

Information not contained in this policy

Further information regarding the processing of personal data may be requested at any time from the Controller using the contact information provided.

EXERCISE OF RIGHTS BY USERS

Individuals to whom personal data relates have the right at any time to obtain confirmation from the Controller as to whether or not such data exists, to know its content and origin, to verify its accuracy or request its completion, deletion, updating, correction, transformation into anonymous form, or blocking of personal data processed in violation of the law, as well as to object, on legitimate grounds, to its processing in any case. Requests should be addressed to the Controller at privacy@mysecretcase.com. It is also possible to file a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).

DISCLOSURE OF PERSONAL DATA TO THIRD-PARTY CONTROLLERS – GNAM LAB S.r.l.

In connection with the purchase of the video course "Yoga per il Benessere Sessuale" ("Yoga for Sexual Wellness"), created in collaboration with GNAM LAB S.r.l. (Giulia Rosso, known as Giuliaredd), MySECRETCASE transfers the personal data provided by the User at the time of purchase (first name, last name, email address) to GNAM LAB S.r.l., which acts as an independent data controller pursuant to Art. 4(7) of EU Regulation 2016/679 (GDPR).

Identification details of GNAM LAB S.r.l.:
COMPANY NAME: GNAM LAB S.r.l.
REGISTERED OFFICE: Via Vigone n. 79, 10064 Pinerolo (TO), Italy
VAT NUMBER: 13092440018
EMAIL: support@giuliaredd.it
WEBSITE: giuliaredd.com

The transfer occurs only after obtaining the User's explicit consent (Art. 6(1)(a) GDPR) via a dedicated checkbox at the time of purchase. This consent is optional and does not affect the completion of the purchase.

Purpose of processing by GNAM LAB S.r.l.: sending informational and promotional communications (newsletters) related to courses, products, and services in the field of psychophysical wellness and yoga.

The User may withdraw consent to the processing of their data by GNAM LAB S.r.l. at any time using the unsubscribe link included in every communication received, or by contacting GNAM LAB S.r.l. directly at support@giuliaredd.it.

For complete information on how GNAM LAB S.r.l. processes the data it receives, please refer to the privacy notice published on giuliaredd.com.

LEGAL NOTE: It is advisable for MYSECRETCASE to check with its DPO whether, in addition to updating the Privacy Policy, it is necessary to enter into a joint controller agreement under Art. 26 GDPR, or whether the transfer instead falls under a relationship between independent controllers requiring only a notice to the data subject.

Flag on that last note: it's not just "advisable," it's a live compliance gap. You're disclosing data to a third party acting as independent controller without having resolved whether Art. 26 applies — that's a decision that should've been made before this clause went live, not flagged as a to-do inside the policy itself.