PRIVACY NOTICE PURSUANT TO SEC. 13 OF EU REGULATION NO. 679/2016 (“GDPR”)
The company Zweb Holding Limited with registered office in P.O. Box 296, St Peter Port, Guernsey, GY1 4NA (hereinafter the Company), in its capacity as data controller in connection with the relevant services provided with regard to the ZWEB application (hereinafter the App), processes the personal data of data subjects (hereinafter the Data Subjects), and in particular of the users that downloaded the App, registered for the creation of an account on the App and use the services available on the App regulated under the Terms and Conditions https://www.zweb.com/terms-of-conditions/ (hereinafter the Services).
The personal data collected are provided directly by the Data Subject when accessing our App, registering on the App and using the Services or are observed by the Company based on the Data Subject’s use of the Services. The Data Subject’s personal data collected and processed by the Company are:
a) the identification data provided by the Data Subject during registration and stored on the App following registration. Such data include: username, e-mail address, date of birth and eventual image of the user profile;
b) personal data included by the Data Subject in comments or content published by the same on the App. Such data include: username, user profile image, biography, as well as the image and voice of the Data Subject when the Data Subject distributes streaming audiovisual works both live (so-called live streaming) and recorded on the App;
c) personal data observed from the Data Subject’s use of the App. Such data include: the App content the Data Subject views or engages with and the pages or people the Data Subject interacts with on the App.
The Company may process the data referred to in point 2 above for the following purposes:
management of the registration on the App, use of the relevant Services and features and to provide personalized App content in a manner which is necessary for the Company’s performance of the Terms and Conditions;
delivery of newsletters and marketing communication, by e-mail and push notification, related to the Services of the same nature to those already used by the Data Subject;
delivery of commercial and promotional communications concerning products and/or services of the other companies of the Company’s group and of the Company’s selected partners;
profiling purposes, i.e. assessment of the tastes and preferences of the Data Subject, including through an invitation to participate in market research;
statistical purposes on anonymized data.
The legal basis for data processing for the purposes under lett. a) is the execution of a contract. Such processing is therefore lawful pursuant to Article 6.1(b) of the GDPR.
The legal basis for data processing for the purpose under lett. b) is the legitimate interest of the Company to offer services of the same nature as those already used by the Data subject in accordance with Article 6.1(f) of the GDPR, unless the Data subject objects at the time of receipt of the notification or subsequently. In particular, the Company may carry out direct marketing activities in the absence of the express consent of the Data Subject (by virtue of an assessment of the prevalence of its interest in sending direct marketing communications, in the absence of real prejudice to the interests, rights and fundamental freedoms of the Data Subject and as provided for in Recital 47 of the GDPR which qualifies the processing of personal data for direct marketing purposes as a “legitimate interest”), but only until receipt of an objection to such processing by the Data Subject.
The legal basis for data processing for the purposes under lett. c) and d) is the Data Subject’s consent. The Data Subject may revoke his/her consent at any time, but this does not affect the lawfulness of the processing based on the consent given by the Data Subject prior to such withdrawal.
The consent of the Data Subject is not necessary for the processing of data in anonymous form for the purpose under lett. e).
The Company hereby informs that for the above mentioned purposes the Data Subjects’ personal data shall be processed also by paper, computer and telematic instruments, on the basis of logical criteria consistent with the purposes for which the data were collected and, in any case, in compliance with all the precautions necessary to ensure the security and confidentiality of the information in accordance with the GDPR. In case of expressed consent to the profiling activity, this processing will entail an automated activity in order to allocate the Data Subject into a category of subjects with homogeneous characteristics on the basis of the Services previously used, any market surveys that may have been completed and the relevant demographic class.
The provision of the data is optional. However, any refusal to provide the data for the purposes referred to under point 3, lett. a) above, shall lead to the impossibility to access and register to the App and use in whole or in part the services offered by the Company. Any opposition to the processing for the direct marketing purposes indicated under point 3, lett. b) above, shall not lead to any consequence, other than the Data Subject not receiving advertising material relating to the Services of the same nature of those already used by the Data Subject. Any refusal to provide consent to the data processing for the further purpose referred to under point 3, lett. c) and d) above, namely for marketing communications concerning products and services of the other companies of the Company’s group and of the Company’s partners and for profiling purposes, shall not lead to any consequences, other than the Data subject not being informed about any marketing and promo-advertising initiatives from the other companies of the Company’s group and the Company’s partners and not receiving commercial communications of interest. The data will be processed in anonymous form for the statistical purposes referred to under point 3 lett. e).
The Data Subject’s personal data will be stored on servers located outside the European Union and the UK, and in particular in the USA. The Company will transfer the Data Subject’s personal data outside the European Union and the UK, and in particular in the USA, to companies that provide the platform hosting the App and development and maintenance services for the platform itself. Before proceeding with the transfer of data to third countries outside the European Union and the UK for which there is no adequacy decision by the European Commission or the UK Government, the Company adopts all the appropriate guarantees under current legislation, so that the transfer of the data can take place in a legitimate and protective manner for the rights of the Data Subject even in the absence of his/her consent. In particular, the Company adopts for the transfer of data to countries outside the European Union and the UK the system of Standard Contractual Clauses approved by the European Commission and the UK Information Commissioner’s Office.
The data collected for the processing purposes indicated in point 3, letter a) above will be stored for the entire duration of the registration of the Data Subject on the App. Subsequently, the personal data will be kept for a period not exceeding (i) the data retention period provided for by the law in force for each category of data; and (ii) the limitation period provided for by law to enforce or defend a right in court against the Data Subject or against third parties. The data collected for the processing purposes indicated at point 3, letter b) above shall be kept until the Data Subject objects to the receipt of advertising material relating to the Services of the same nature as those already used by him/her, except in the case where it is necessary to keep the data in order to provide a service to the Data Subject, to defend the rights of the Company in relation to disputes existing at the time of the request or on indication of the public authorities. The data collected for the purposes of processing indicated in point 3, let. c) and d) above shall be retained until the Data Subject has withdrawn consent to to receiving commercial communications from the Company’s partners and to the profiling activities, or requests the deletion of the data, except where it is exceptionally necessary to retain the data in order to defend the rights of the Company in relation to disputes existing at the time of the request or at the indication of the public authorities.
Pursuant to Articles 15-22 GDPR, the Data Subject has the right to: a) obtain information in relation to the purposes for which the personal data are processed, the period of processing and the persons to whom the data are communicated (so-called right of access); b) obtain the correction or integration of inaccurate personal data (so-called right of rectification); c) obtain the deletion of personal data in the following cases (i) the data are no longer necessary for the purposes for which they were collected; (ii) the Data Subject has withdrawn his/her consent to the processing of the data if they are processed on the basis of his/her consent; (iii) the Data Subject has objected to the processing of personal data concerning him/her if they are processed for a legitimate interest of the Company; or (iv) the processing of personal data does not comply with the law. However, we point out that the storage of personal data by the Company is lawful if it is necessary to enable it to fulfil a legal obligation or to ascertain, exercise or defend a right in a court of law (so-called right of deletion); d) to obtain that personal data are only stored without any other use being made of them in the following cases (i) the Data Subject contests the accuracy of personal data, for the period necessary to allow the Company to verify the accuracy of such personal data; (ii) the processing is unlawful but the Data Subject opposes the deletion of personal data by the Company; (iii) the personal data are necessary to ascertain, exercise or defend a right in court; (iv) the Data Subject has opposed the processing and is awaiting verification of the possible prevalence of the legitimate reasons of the Company to the processing over those of the Data Subject (so-called right of limitation); e) receive in a format for common use, readable by automatic and interoperable device, personal data concerning the Data Subject, if they are processed by contract or on the basis of the consent of the Data Subject (so-called right of portability).
Data Subjects in the EU or the UK have the right to contact the supervisory authority in the country in which they are based, in order to assert his/her rights in relation to the processing of personal data. For example, a Data Subject based in the UK can contact the Information Commissioner’s Office.
The data controller, pursuant to art. 24 of the GDPR, is Zweb Holding Limited with registered office in P.O. Box 296, St Peter Port, Guernsey, GY1 4NA. At any time, the Data Subject may exercise the rights established by law or send requests, by contacting the data controller at the e-mail address [email protected].