Privacy Policy

Informative Version: 4.0 of 28/02/2020

This Policy describes the types of data that we may collect and process through the use of the ADA platform and/or pages managed by TataRuga, describing its collection, use, retention, protection, and disclosure practices. What follows is directed at End-Users or Interested citizens/residents of the European Union. For citizens and Swiss residents, Federal Data Protection Act No. 235.1 (LPD) applies.

Data controller

TATARUGA Sagl, with registered office at c/o Gescam Sagl – Via Laveggio 21, 6850 Mendrisio (Switzerland) – VAT CHE-338.860.159 – email isabella.grassi@myhobbyshop.ch (hereinafter also referred to as, “TATARUGA”, or the “Data Controller”), is a Swiss company specialized in the sale of games and creative products, which are promoted and sold through participation in fairs and events, through stores present in the Swiss territory and online, on behalf of its legal representative, guarantees compliance with the discipline regarding the protection of personal data by providing the following information regarding the processing of the data communicated or otherwise collected during the use of ADA platform (the “platform” or “ADA”) and/or other digital marketing platforms.

Definitions
Data controller: the natural person, the legal person, the public administration and any other entity, association or body to which it is assigned, including together with another data controller, the decisions regarding the purposes, methods of processing personal data and the instruments used, including the information security profile.

Data controller: The person, company, entity, association or organization to whom the controller entrusts, also externally, with management and control tasks regarding the processing of data, based on their particular experience or skills.

End-User or Interested Party: These terms refer to anyone who navigates through one of the websites managed by TATARUGA; they are a customer, or a potential customer of TATARUGA (having purchased directly within the points of sale or by mail the products and services offered); they use an APP managed by TATARUGA; they are contacted or provide data through one of the digital marketing platforms used by TATARUGA, such as “ADA”, or directly within one of TATARUGA’s locations. In the case of minor Italian citizens, the provisions indicated in Article 2-quinquies of Legislative Decree 196/03 (with the amendments introduced by Legislative Decree 101/18) apply.

ADA: One of the digital marketing platforms used by TATARUGA.

ChatBot: A Chatbot, chatbot or chatterbot is software designed to simulate a conversation with a human being. The main purpose of these software is to simulate human behavior and they are used for various purposes such as online guidance, responding to FAQs of users accessing a website etc.; the Owner may offer within its web spaces the possibility for end-users and customers to interact with a chatbot to offer the services requested by the end-user, improve the user experience by disclosing information (description of services, products, promotions, etc.) and to acquire contact information.

Websites: The websites or web pages managed by the Owner such as www.myhobbyshop.ch.

Personal Data: We consider personal information to be any information that is voluntarily submitted and that personally identifies someone, including contact information such as name, email address, company name, address, phone number and other information about you or your business. Personal Information may also include information about any transaction, whether free or paid, information available on the Internet, such as from Facebook, LinkedIn, Twitter and Google, or information publicly available. When the end user registers or logs in through one of their social channels, based on the settings of their social accounts, certain data is shared with the ADA platform or one of the TATARUGA websites. In addition, we also consider credit or debit card numbers, information about personal financial accounts, passport numbers, or other identity documents to be particularly sensitive personal data.

Specific Data: Also known as “sensitive” data, we consider racial or ethnic origin, religious beliefs, philosophical beliefs, political opinions, trade union membership, information related to health, sexual orientation and sexual life, as well as biometric and genetic data, to be special data.

Navigation Information: Refers to information present on your computer and visits to this website (and other websites managed by TATARUGA), such as IP address, geographic location, browser type, referral source, duration of visit, and pages viewed.

Consent: It refers to the free expression of the will of the interested party, with whom they expressly accept a specific treatment of their personal/sensitive data, of which they have been previously informed by the Data Controller.

3. Data processed, purposes and legal bases of the processing
Data generated by accessing the site
The IT systems and software procedures used to operate the websites managed by the Data Controller and the ADA digital marketing platform acquire certain personal data during their normal operation, the transmission of which is implicit in the use of Internet communication protocols.
These data (such as domain names, IP addresses, operating system used, type of browser device used for connection) are not accompanied by any additional personal information and are used to:

I) to derive anonymous statistical information on the use of the platform;

II) manage requirements for controlling the manner in which it is used;

III) determine responsibility in the event of hypothetical cybercrimes.
The legal basis that legitimizes the processing of such data is the need to make the website’s functionality usable following the user’s access.

Data provided voluntarily by the user
Personal information, which includes name, postal address, email address, telephone number, IP address or any other identifier for contacting the interested party online or offline, or any other information that can be attributed directly or indirectly to the interested party and that will be provided by the interested party themselves through the registration procedure that can take place in paper form and directly, through the acquisition of data during the subscription to one of the loyalty programs offered by the owner, or via online forms, are collected and processed for the following purposes:

for the performance of the contract: in the case of a subscription or the conclusion of a contract between TATARUGA and the counterparty (end-user). This includes administrative purposes, payment management and for the fulfilment of legal obligations such as those of a fiscal or accounting nature, or to comply with requests from the judicial authorities;

with specific consent, for marketing activities such as the periodic sending, via email, of newsletters and advertising material and to receive updates on our activities, reports on promotional communications and invitations to events, training courses, webinars, special promotions, to participate in market analysis and research or commercial communication using automated contact methods, or through remote communications (e.g., via mobile and landline networks, via SMS, MMS, etc.) and traditional (paper mail);

With specific consent, the data will be processed for profiling purposes, in particular to create a commercial profile and/or to analyze preferences, habits or consumption choices, also by cross-referencing such personal data with other information collected through profiling cookies possibly accepted. The processing of your personal data for profiling purposes will be carried out using tools and in ways better described in the next paragraph 5 (Mode of processing).

Data collected through the ADA Platform
As part of the data processing and regarding the sending of communications addressed to the customer, the data controller will also use the ADA platform itself, which, through statistical tracking systems, allows the detection of the opening of a message, the clicks made on the hypertext links contained within the email, the IP address from which the email is opened, and the type of browser used to open the email, and other similar details. The collection of this data is necessary for the use of the platform and forms an integral part of the functionality of the message delivery system.
The legal basis that legitimizes the processing of such data is the execution of a contract to which the interested party is a party.

3.1 The technologies that TATARUGA and third parties that provide content and applications may use for this automatic data collection include:

COOKIES. A cookie is a small file placed on your computer’s hard drive. You can refuse to accept cookies by properly configuring your browser. However, if you choose this option, you may not be able to access some of the services of the ADA platform or the websites managed by TATARUGA. Unless you have adjusted your browser settings to reject cookies, our system may issue cookies during your use of the ADA platform or the websites managed by TATARUGA. In the browser, you can disable the storage of cookies or remove the cookies that have been recorded, but this may result in reduced functionality, a slowdown, or the inability to use some parts of the ADA platform or the websites managed by TATARUGA. For more information about cookies and how to delete them depending on the type of browser used, please refer to: www.allaboutcookies.org.

The ADA platform and the websites managed by TATARUGA use the following types of cookies:

Strictly necessary cookies are those that allow you to visit the ADA website, use its functions, and access the protected and reserved areas for registered users. If the use of these cookies is disabled, some parts of the ADA platform may not be able to be used properly.

Functional cookies and saving preferences are cookies that allow the ADA platform and the websites managed by TATARUGA to record choices (such as the user name, the choice of language and country, the character and size of the script, the password, etc.), as well as visitor preferences (such as the pages visited, etc.), in order to facilitate the use of the platform and be able to offer visitors a more relevant and personalized experience.

The ADA platform uses the following cookies:

Name

Purpose

Deadline

Description

Supplier

PHPSESSID

Technical cookie

browser closure

The PHPSESSID cookie is a native PHP cookie and allows websites to store data about the state of the session. It is used on the website to establish a user session and to communicate the state data through a temporary cookie, commonly called a session cookie. Since the PHPSESSID cookie has no expiration time, it disappears when the client closes the browser.

Owner

Analytics

Tracking navigation

30 days

necessary for tracking visitors and visits related to the content, so it is only used for the Tools (Landing, StoryTelling, etc.)

Owner

__cdnjd

Technical cookie

browser closure

The Cloudflare __dnjd cookie is used to manage the Javascript and CSS libraries used on the platform. It always uses HTTPS. https://cdnjs.com/libraries

Third parties

4. Nature of the donation
Apart from what is specified for navigation data and for data collected through the ADA Platform, the provision of the data:

In accordance with the purposes set out in point 3, letter a), it is mandatory and any refusal will make it impossible for TATARUGA to fulfill the contractual obligations it has undertaken.
Compared to the purposes set out in point 3, letters b) and c), adherence is optional and the use of data for these purposes is strictly conditional upon the granting of explicit consent by the customer or end-user. Any refusal to process all or part of the data will make it impossible for TATARUGA to carry out the processing for the purposes described.

5. Methods of processing and periods of data retention
The collected data will be processed using electronic or other automated tools, computer-based and telematics, or through manual processing using logics strictly related to the purposes for which the personal data were collected and, in any case, in such a way as to guarantee the security of the data in every case. The data are kept for the time strictly necessary to manage the purposes for which the data are collected in compliance with the applicable regulations and legal obligations.

In any case, TATARUGA and the respective data processors appointed by it apply rules that prevent the data from being kept for an indefinite period of time and therefore limit the retention period in compliance with the principle of minimizing data processing by conducting a periodic review every year on the data processed and the possibility of deleting them if they are no longer necessary for the intended purposes.

The processing of personal data for profiling purposes will take place, subject to consent, using data processing tools that, when combined, will create a commercial and behavioral profile on the web. This data processing tool also correlates the data collected during navigation on the web pages through the use of first-party profiling cookies with the data collected through the previously specified methods.

6. Data processing authorized parties, responsible parties and data communication
The processing of the collected data is carried out by personnel appointed by TATARUGA for this purpose, identified and authorized to process it in accordance with specific instructions given in compliance with current regulations.

The data collected, if necessary or instrumental for the execution of the indicated purposes, may be processed by third parties appointed as external Data Processors, (whose updated list can be requested by email at isabella.grassi@myhobbyshop.ch) and, as appropriate, communicated to them as independent data controllers, namely:

Companies of the TATARUGA group for the purposes referred to in point 3, letters a) and b);
Individuals, companies, associations or professional firms that provide assistance and advice to our Company for the purposes set out in point 3, letter a);
III) Third-party entities that provide content and value-added services requested by the end-user;
IV) Companies, organizations and associations that provide services related to and instrumental to the execution of the above-mentioned purposes (analysis and market research services, management of credit card payments, maintenance of computer systems).
Public authorities, upon the occurrence of the prerequisites.
The data controllers appointed by TATARUGA will process the data only as instructed by TATARUGA itself and are authorized to process them for different purposes for the purposes for which they were collected. All data will be used exclusively and limited to the purposes determined following the contracts signed.

Furthermore, the personal data collected and processed will never be disclosed.

7 Transfer of personal data outside the EU
Your data may also be processed by IT service providers, in their capacity as Data Processors. If they operate outside the European Union, TATARUGA, in compliance with the regulations on data transfer to a non-European country, undertakes to conclude, if necessary, agreements that guarantee an adequate level of protection and/or to sign the necessary contractual clauses.

8. Rights of the interested party
At any time, you can access the data, verify its existence, know its origin, object to the processing, or request the deletion, modification, or updating of all personal information collected by TATARUGA, exercising the right to limit the processing and the right to data portability by sending an email to the address isabella.grassi@myhobbyshop.ch using the email account chosen during registration for the services offered.

It is also possible to file a complaint with an Italian supervisory authority, the Data Protection Authority (link: https://tinyurl.com/y53c4ye2).

9. Details on data security

Personal data is protected by technical, IT, organizational, logistical and procedural security measures against the risks of destruction or loss, even accidental, and unauthorized access or unauthorized processing. These measures are updated periodically based on technical progress, the nature of the data and the specific characteristics of the processing, are constantly monitored and verified over time. These security measures correspond to the requirements that the Data Controller and the persons appointed by it have identified as adequate. Periodic “Risk Analysis” activities are carried out to verify compliance with the adopted security protocols and new security measures are introduced or updated, if necessary, following organizational changes and technological innovations or changes in the type of data collected. The security measures are constantly monitored and periodically verified.

The data protection officer is Isabella Grassi, of TataRuga Sagl, at Via Maria Ghioldi Schweizer 5, 6850 Mendrisio.
Email: isabella.grassi@tataruga.ch