Privacy and Cookies

Privacy Policy

INFORMATION ON THE PROCESSING OF PERSONAL DATA pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR)

Preamble

This information is provided for the website “https://inastra.com” (Site) owned by ScentFactory srl, with registered office in via Roma 344 Ispra (VA) IT, registered with the Chamber of Commerce of Varese, with VAT No. 11227810964, with tax code 11227810964 (Data Controller), as the Data Controller pursuant to the GDPR.

Purchases on the Site

Subject to your provision, your personal data will be processed to allow you to make purchases on the Site.

Registration

The information and data requested in case of registration will be used to allow you both to access the reserved area of the Site and to use the online services offered by the Data Controller to registered users.

Marketing

Subject to your consent, the Data Controller may process the personal data you provide in order to send you advertising material and/or newsletters relating to its own products or those of third parties.

Profiling

Subject to your consent, the Data Controller may process your personal data for profiling purposes, i.e., for the analysis of your consumption choices through the detection of the type and frequency of purchases you make, in order to send you advertising material and/or newsletters relating to its own products or those of third parties, of your specific interest.

Soft spamming

The Data Controller may use, for the direct sale of products offered for sale through the Site, the email coordinates you provided in the context of a purchase on the Site, even without your consent, as long as it is a product similar to the subject of the previous sale (so-called soft spamming). You may, however, refuse this processing at any time by communicating your opposition to the Data Controller.

***

In compliance with the GDPR, we hereby intend to inform you that the Data Controller will process the personal data concerning you under the following conditions.

Art. 1. Purpose and legal basis of processing. Mandatory or optional provision. Consequences of refusal to process.

The processing of personal data is aimed at achieving the following purposes:

a. to allow “registration to the Site and access to services reserved for registered users as well as to allow compliance with obligations arising from law or regulations in force, particularly in administrative, accounting, public security areas. The legal basis for the processing is the need of the Data Controller to execute pre-contractual measures adopted at the request of the” data subject or to comply with a legal obligation;

b. in the case of an online purchase order, to allow the conclusion of the purchase contract and the correct execution of operations related to it (and, if necessary according to sector regulations, to fulfill tax obligations). The legal basis of the processing is the “obligation of the Data Controller to execute the contract with the” data subject or to comply with legal obligations;

c. limited to the email coordinates you provided in the context of a purchase through the Site, to allow the direct offer by the Data Controller of similar products (so-called soft spamming), provided that you do not object to such processing in the manner provided for in this information. The legal basis of the processing is the legitimate interest of the Data Controller to send this type of communication. This legitimate interest can be considered equivalent to the interest of the data subject in receiving “soft-spam” communications;

d. subject to your consent, for sending newsletters and conducting market surveys, including those aimed at assessing the degree of user satisfaction, and sending advertising material relating to products of the Data Controller and/or third parties, by means of systems such as email (marketing purposes); subject to your consent, for the elaboration of your commercial profile, through the detection and processing of your purchasing choices and habits, in order to both monitor the degree of customer satisfaction and send you advertising material, relating to products of the Data Controller and/or third parties, of your specific interest, by means of systems such as email (profiling purposes). The legal basis of the processing is the consent of the data subject;

e. to respond to your requests through the customer care service. The provision is optional, but your refusal will result in “the impossibility for the Data Controller to respond to your questions through this service. The legal basis for the processing is the legitimate interest of the Data Controller to follow up on the” user’s requests. This legitimate interest is equivalent to the “interest of the” user in receiving a response to the communications sent to the Data Controller;

f. to respond to your requests via email. The provision is optional, but your refusal will result in “the impossibility for the Data Controller to respond to your requests. The legal basis for the processing is the legitimate interest of the Data Controller to respond to the” user’s requests. This legitimate interest is equivalent to the “interest of the” user in receiving a response to the communications sent to the Data Controller.

The provision of data for the purposes referred to in points a) and b) is purely optional. However, since this processing is necessary to make a purchase on the Site, your refusal to provide the data in question will result in the impossibility of making such a purchase through the Site.

Consent to the processing of your data for marketing and profiling purposes is purely optional. Failure to consent will only result in the consequences described below.

Failure to consent to the processing of data for marketing purposes will result in “the impossibility for you to receive advertising material related to products of the Data Controller and/or third parties as well as the” impossibility for the Data Controller to conduct market research, including those aimed at evaluating the degree of user satisfaction, as well as to send you newsletters.

Failure to consent to the processing of your personal data for profiling purposes will result in the impossibility for the Data Controller to develop your commercial profile by detecting your choices and purchasing habits as well as to send you advertising material related to products of the Data Controller and/or third parties that are of specific interest to you.

Without prejudice to the above, it is understood that the Data Controller may still use your personal data for the sole purpose of correctly fulfilling the obligations provided for

by the laws in force and the obligations arising from the contractual relationships existing between you and the Data Controller.

If you have registered on the Site, you may in any case modify your consent for the purposes described above at any time by accessing your personal page.

We remind you that you may object to the processing of your personal data also through the appropriate link present at the bottom of any promotional email sent by the Data Controller.

Social network

By choosing the “option of registration and/or access to the Site via Facebook and Instagram, you agree that the respective social networks used from time to time to access the Site transmit to the Data Controller the personal data necessary for registration and/or” access.

Payment card data

To make a payment through one of the payment cards offered on the Site, the user must enter the confidential data of the payment card directly on a page that will communicate through a secure encryption protocol with the payment service provider (who will act as an independent data controller), without passing through the server of the Data Controller who, therefore, will not process such data in any way. The data will be acquired in encrypted format.

With reference to the payment card data, it is specified that the processing of your personal data is necessary to allow the conclusion of the online purchase contract with the Data Controller. Failure to provide this data, therefore, will not allow you to complete the online purchase process.

PayPal

On the Site, it is also possible to purchase through the PayPal payment tool. In this case, you will be directed to a page external to the Site, where you must provide the personal data requested by PayPal – which will act as an independent data controller – to complete the purchase process. The personal data will not pass through the Site’s server, which, therefore, will not process such data in any way. The processing of your personal data is necessary to allow the conclusion of the online purchase contract with the Data Controller. Failure to provide this data, therefore, will not allow you to complete the online purchase process.

Special or judicial data

The Data Controller does not process special or judicial data.

Art. 2. Processing Methods

The processing of your personal data will be primarily carried out with the aid of electronic or automated means, according to methods and with tools suitable to ensure security and confidentiality in compliance with the GDPR.

The information acquired and the processing methods will be relevant and not excessive in relation to the type of services provided. The data will also be managed and protected in environments where access is under constant control.

Art. 3. Communication and Dissemination of Data

Your data may be communicated to:

• all those subjects (including Public Authorities) who have access to personal data by virtue of regulatory or administrative provisions
• companies or third parties in charge of printing, enveloping, shipping and/or delivery and/or collection of products purchased through the Site
• post offices, couriers, suppliers (e.g., drop shipping sales) or shippers responsible for delivering products purchased through the Site
• banking institutions and companies that manage national or international payment circuits through which online payments are made for products purchased through the Site
• companies, consultants or professionals possibly in charge of “installation, maintenance,” updating and, in general, management of hardware and software of the Data Controller or which the “latter uses for the” provision of its services
• external companies in charge of sending advertising communications on behalf of the Data Controller
• employees and/or collaborators of the Data Controller
• the company in charge of carrying out customer care activities

• subjects managing online payment transactions
• all those public and/or private subjects, natural and/or

legal persons (legal, administrative and tax consulting firms, Judicial Offices, Chambers of Commerce, Labor Offices and Chambers, etc.), if the communication is necessary or functional for the correct fulfillment of obligations arising from the law.

Data concerning you will not be disseminated, except in anonymous and aggregated form, for statistical or research purposes.

Art. 4. Data Controller

The Data Controller can be contacted at the following addresses:

ScentFactory srl via Roma 344 Ispra (VA) IT Email: info@inastra.com
Through the contact form on the Site.

Art. 5. Retention of Personal Data

Personal data will be stored and processed for marketing purposes for a period of 24 months and for profiling purposes for a period of 12 months. At the end of this period, the Data Controller may ask the user to renew consent to the processing of their data for these purposes or make them anonymous and store them only for statistical or historical purposes.

For all other purposes provided in the privacy policy, personal data will be retained only for the time necessary to ensure the correct provision of the services offered.

In case of closure of the “Site account on the user’s” initiative, the data reported therein will be retained for administrative purposes for a period not exceeding 90 days, without prejudice to any specific legal obligations on the retention of accounting documentation or for public security purposes.

Art. 6. Rights of the Data Subject

Pursuant to Art. 13 of the Privacy Regulation, the Data Controller informs you that you have the right to:

• ask the Data Controller for access to personal data and rectification or erasure of the same or restriction of processing concerning you or to object to their processing, in addition to the right to data portability
• withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal
• lodge a complaint with a supervisory authority (e.g., the Data Protection Authority).

The above rights may be exercised by request made without formality to the Data Controller at the contacts indicated above.

Art. 7. Modifications

The Data Controller reserves the right to make changes to this information at any time, providing appropriate publicity to the Site users and ensuring in any case an adequate and similar protection of personal data. In order to view any changes, you are invited to regularly consult this information.

EXTENDED COOKIE POLICY

Preamble

This information is provided for the website “https://inastra.com” (Site) owned by ScentFactory srl, with registered office in via Roma 344 Ispra (VA) IT, registered with the Varese Chamber of Commerce with VAT no. 11227810964 (Company), as Data Controller.

What are cookies and what are they for

A cookie is a text file that a website visited by the user sends to their device (computer, mobile device such as smartphone or tablet), where it is stored to be retransmitted to that site on a subsequent visit to the same site.

Cookies are distinguished from each other:

• based on the subject that installs them, depending on whether it is the same manager of the visited site (“first-party cookies”) or a different subject (“third-party cookies”);
• based on the purpose of each cookie: some cookies allow better navigation, storing some user choices, for example the language (“technical cookies”), other cookies allow monitoring of user navigation also for the purpose of sending advertisements and/or offering services in line with their preferences (“profiling cookies”).

Only profiling cookies require the user’s prior consent for their use.

The Site uses first-party technical and profiling cookies as well as third-party profiling cookies.

The Company is solely responsible for the first-party cookies it installs on the Site.

How to express consent to profiling cookies

On your first visit to the Site, you can accept all cookies by performing one of the following actions:

• clicking the “Accept and Close” button in the banner itself.

On your first visit to the Site, if you do not perform any of the actions described in the banner but, from the banner, access this extended information, you can interact with the individual consent modules possibly present in the extended information where it is possible to give and/or deny consent, depending on the case, to the installation of cookies by clicking on the appropriate link reported in the column “privacy policy and consent form” of the table below. Please note: if you do not interact with the consent modules and exit the extended information, closing the page in which the information is contained or continuing navigation on the Site, you give consent for all cookies.

On subsequent visits to the Site, you can access the extended information through the “Cookie Policy” link, present on the Site and deny consent to the installation of first-party and/or third-party profiling cookies.

In any case, it is possible to express consent to the release of cookies through the browser settings. The procedure to follow to configure the relevant settings is as follows:

Internet Explorer
Click the following link: http://windows.microsoft.com/en-us/internet-

explorer/delete-manage-cookies#ie=ie-11.

Google Chrome

Click the following
link: https://support.google.com/accounts/answer/61416?hl=en.

Mozilla Firefox

Click the following
link: https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences.

Safari

Click the following
link: https://support.apple.com/guide/safari/manage-cookies-and-website-data-sfri11471/mac.

In case of devices such as smartphones, tablets, etc., we ask you to verify that each browser on each device is set to express your preferences regarding cookies. For third-party cookies, you can also set your preferences through the website www.youronlinechoices.com (the system operates with reference to the companies adhering to this site).

Cookies installed through the Site

First-party profiling cookies that require the user’s prior consent

Third-party profiling cookies that require prior user consent

Statistical and analytical cookies

The Site uses third-party cookies, also in disaggregated form, for statistical and analytical purposes.

Retargeting profiling cookies

The Company uses advertising profiling cookies to deliver interest-based advertising based on internet browsing behavior.

Social network cookies

Social network cookies allow interactions with social platforms, or other external platforms, directly from the Site pages.

The following table refers to the social network cookie provider used through the Site.

Additional Information
Regarding cookies installed by the Site, please note that:

• data is collected exclusively for the purposes indicated in this policy;
• technical cookies do not require prior user consent as they are necessary for the Site’s operation. Removing these technical cookies could negatively affect Site navigation;
• data collected by first-party cookies may be communicated to subjects acting on behalf of the Company as Data Processors pursuant to Regulation (EU) 679/2016 on personal data protection (GDPR) and as described in the privacy policy that you can view by clicking on the following link “Privacy Policy” present on the Site.

Regarding the Company’s “profiling” cookies in particular, it should be noted that their deactivation does not result in the “impossibility of navigating” within the Site.

The purposes and use of third-party cookies are determined by those third parties.