Privacy policy

Dear Data Subject,

with this document (the ‘Information Notice’), we would like to renew our commitment to ensuring that the processing of your personal data, collected through website, is carried out in full compliance with the protections and rights recognised by Regulation (EU) 2016/679 (“GDPR” or the “Regulation”) and Legislative Decree 196/2003 (“Privacy Code”), as amended and supplemented, as well as by further applicable regulations on the protection of personal data.​

The term personal data refers to the definition contained in Article 4, paragraph 1 of the Regulation, namely “any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person” (the “Personal Data”).​

The purpose of this Information Notice – drawn up on the basis of the principle of transparency and including all the elements required by Art. 13 of the Regulation – is to provide, in a simple and intuitive manner, all the useful and necessary information so that the provision of personal data can be provided in a conscious and informed manner and, in the event of a change in circumstances, all the rights provided for by the GDPR may be exercised.

​

THE DATA CONTROLLER

Pursuant to Article 26 of the Regulations, the companies that will process your Personal Data for the purpose set forth in this Notice and that, therefore, will play the role of data controller or, as the case may be, co-processor, are the companies belonging to the Longevity Group, specifically:

• Longevity S.p.A., Via Alberto Da Giussano n.15, ZIP 20145 Milan (MI), VAT 10680570966;
• Lipinutragen S.r.l., Via Corticella n.181/4, ZIP 40128 Bologna (BO), VAT 02604871208;
• Longevity Medical S.r.l., Via Arpa n.8, ZIP 43123 Parma (PA), VAT 02591160342;
• Longevity Kitchen S.r.l., Via Alberto da Giussano n.15, ZIP 20145 Milan (MI), VAT 12048670017;
• The Longevity Suite Switzerland SA, Riva Paradiso 2 6900, Lugano, Svizzera,  VAT CH422706576
• The Longevity Suite Spain SL, Calle José Abascal 56, 28003 Madrid Spagna, VAT ESB67999250

(individually the “Data Controller,” jointly the “Longevity Group”).

The Longevity Group has entered into an inter partes joint controllers agreement, whereby the individual companies have agreed to:

• jointly determine certain purposes and methods of Processing your Personal Data;
• jointly determine, in a clear and transparent manner, the procedures for providing you with timely feedback should you wish to exercise your rights, as provided for in Articles 15, 16, 17, 18 and 21 of the Regulations as well as in the cases of portability of Personal Data provided for in Article 20 of the Regulations, as better described within the appropriate Section of this Notice;
• jointly define this Notice in the parts of common interest, indicating all the information required by the Regulation.

The essential content of the agreement is available at Longevity Group and can be provided upon specific request by the Interested Parties, to be forwarded to the contacts indicated in this Disclosure.

THE DATA PROTECTION OFFICER

The Data Controller, in order to facilitate relations with Data Subjects, has appointed its Data Protection Officer (the “DPO”), identifying SAPG Legal Tech S.r.l., with registered office in Corso Europa n. 7, 20122 – Milan.

As provided for in Article 38 of the GDPR, the Data Subject may freely contact the DPO for all matters relating to the processing of Personal Data and/or in case he/she wishes to exercise his/her rights as provided for in this Notice, by sending a written communication to the e-mail address: dpo.privacy@sapglegal.com.

TYPES OF DATA PROCESSED

The Personal Data collected by the Data Controller – n order to pursue the purposes indicated below – may include: first name, last name, e-mail address, tax code, telephone number, as well as the address useful for shipping including street, house number, zip code, city, province and country, navigation data and data belonging to special categories (for the execution of food and genetic tests and for the execution of consultations) and data pertaining to work experience (for the submission of resumes). Personal Data may be processed according to the purposes and related legal bases set forth below.

1. Improving the browsing experience and monitoring the proper functioning of the Site. 

The information systems and software procedures used to operate the platform acquire, during their normal course of operation, certain personal data whose transmission is implicit in the use of Internet communication protocols.

This category of data includes, by way of example, your information relating to: your IP address, operating system, access time, time spent on the individual page, internal path analysis, other parameters relating to your operating system and computer environment.

This technical/informational data is collected and used exclusively in an aggregate and non-identifying manner and could be used to ascertain liability in the event of hypothetical computer crimes against the platform. 

The processing will be legally based on the legitimate interest of the Controller in ensuring the optimal functioning of their systems, optimizing and improving your browsing experience, preventing fraudulent activities, and enhancing the security of the platform (art. 6, paragraph 1, letter f), of the GDPR).

2. Enabling you to benefit from product sales-purchase services.

Your Personal Data is necessary to enable you to conclude transactions. They are also essential to manage the shipping of the purchased product.

This Personal Data is needed to manage contractual activities related to the acceptance of specific clauses of the sales contract.

This purpose of processing is justified by the performance of the contract to which you are a party or by pre-contractual measures taken at your request (art. 6, paragraph 1, letter b), of the GDPR).

3. Fulfilment of current accounting and tax obligations, obligations laid down by law, by a Regulation, by Community legislation or by an Order of the Authority (in particular tax, anti-money laundering, banking and public safety), as well as by supervisory and control bodies and for anonymous and aggregate statistical purposes.

The legal basis for this processing is compliance with legal obligations (art. 6, paragraph 1, letter c), of the GDPR).

4. Control unlawful conduct and/or prevent other unlawful acts or fraud, as permitted by applicable law.

The legal basis for such processing is the legitimate interest of the Data Controller (art. 6, paragraph 1, letter f), of the GDPR).

5. Ascertaining, exercising or defending a right of the Data Controller in judicial and/or extrajudicial proceedings.

The legal basis for the exercise or defence of a right of the Controller shall be that of legitimate interest, as referred to in art. 6, paragraph 1, letter f of the GDPR.

6. Direct marketing by the Data Controller.

The term refers to the conduct of promotional activities (using both automated and traditional methods) for the services of your interest provided by the Data Controller. Regarding this direct marketing purpose, it should be pointed out that, by virtue of Article 6, paragraph 1, letter f) of the Regulation and art. 130, paragraph 4, of the Privacy Code (the so-called soft spam exception), the Data Controller may carry out this activity on the basis of your legitimate interest, regardless of your explicit consent, as explained in greater detail in Recital 47 of the Regulation, which states “The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest”. This will be possible as a result of the assessments made by the Data Controller regarding the possible and possible prevalence of your interests, rights and fundamental freedoms requiring the protection of your Personal Data over its own legitimate interest in sending direct marketing communications. Moreover, you may lawfully object at any time (even partially) to receiving promotional communications, without this affecting in any way the processing for the other purposes.

This processing, therefore, will be legally based on the legitimate interest of the Data Controller pursuant to art. 6, paragraph 1, letter f), of the GDPR.

7. Sending – through automated contact methods (e.g., SMS, MMS, email, etc.) – of promotional and commercial communications, advertising material related to the activities of Longevity Group

This purpose of processing is justified by your optional, freely given, and revocable consent at any time (pursuant to art. 6, paragraph 1, letter a), of the GDPR).

8. Profiling purposes, or analysis of habits, preferences, behaviour, interests deduced, by way of example, based on online actions on sections of the Site in order to send you commercial communications.

The processing of your personal data for profiling purposes will take place, in case of consent, with data processing tools that, following cross-referencing, will create a commercial and behavioural profile of you on the web. This data processing tool correlates the data collected during your navigation on the Site through the use of first-party profiling cookies you have accepted with the data collected through the completion of the online form. Additionally, this data and/or information will be associated with any other data and/or information we already hold as a result of your subscription to our services.

This purpose of processing is justified by your optional, freely given, and revocable consent at any time (pursuant to art. 6, paragraph 1, letter a) of the GDPR).

9. Perform food and biological testing 

Your Personal Data is needed to finalize the purchase transaction of food and genetic tests. Such tests collect your blood, fecal, and genetic samples in order to finalize the completion of the test.

This purpose of processing is legitimized by optional, free and revocable consent at any time (Art. 9(2)(a) GDPR).

10. Contacting us

These data are also essential for managing your requests for assistance and/or information about the services offered, existing contracts, and payments. Your Personal Data will be used for the purpose of following up on your request to contact the nutritionist and/or medical specialist.

This purpose of processing is legitimised by the performance of pre-contractual measures or of the contract to which you are party (pursuant to art. 6, paragraph 1, letter b) of the GDPR).

11. Create an account and log in to the restricted area

Your Personal Data will be used to create your account in the restricted area.

This purpose of processing is legitimized by your optional, free and revocable consent at any time as it may also involve health data (pursuant to Article 9(2)(a) of the GDPR).

12. Candidates for job positions.

Your Personal Data will be provided for the purpose of carrying out personnel selection and evaluation activities, in the interest of the Company. Data collection is done by sending information about your professional experience also in the form of a Curriculum Vitae (“CV”) through spontaneous application by filling in the form available on the dedicated page.

This purpose of processing is legitimized for the execution of pre-contractual measures taken on the basis of your request (pursuant to Art. 6, para. 1(b), GDPR). Also pursuant to Article 111-bis, Legislative Decree 196/2003, consent is not required.

The Data Controller, in order to proceed with generic marketing activities and those in respect of which you have given your consent, will create a personal profile for you internally in its centralised management system (CRM). Your potential request to opt-out with respect to generic marketing activities and/or the revocation of any consent you may have given does not entail the deletion of the aforementioned personal profile from CRM as well, unless you exercise your right to do so in the manner provided for in this policy in the section entitled “Fundamental rights of the data subject”. After the above mentioned storage periods, the Personal Data will be destroyed, deleted or anonymized, compatible with the technical procedures of deletion and backup and with the requirements of accountability on the part of the Data Controller.

Please note that consent is free, optional and revocable. Therefore, where under any form only one consent is required, where it is issued, it will be understood as specific for that purpose and no other purpose that provides the legal basis of the consent.

If you have given consent (in whole or in part) to the processing of your Personal Data for the purposes set out above, you may at any time withdraw it in whole and/or in part without prejudice to the lawfulness of the processing based on the consent given before withdrawal. The possible revocation of the consent will require the Data Controller to cease processing your Personal Data for these purposes. The methods of revoking consent are very simple and intuitive: you will just need to contact the Data Controller using the contact channels listed in this Policy.

AREA OF COMMUNICATION AND DISSEMINATION OF DATA

Your Personal Data may be managed, on behalf of the Data Controller, exclusively by personnel expressly authorised to process them (pursuant to art. 29 of the Regulations and art. 2-quarter decies of the Privacy Code) and by third parties expressly appointed as data processors (pursuant to art. 28 of the Regulations), in order to properly perform all processing activities necessary to pursue the purposes set out in this Policy.

For illustrative purposes only, some categories of individuals to whom your Personal Data may be communicated are listed below:

1. business partners of the Data Controller providing services, in their capacity as data processors or independent data controllers, for the purposes referred to in art. 6, paragraph 1, letter b) of the Regulation; 
2. third-party service providers of assistance and advice in the capacity of data processors or independent data controllers, for the purposes set out in art. 6, paragraph 1, letter b), of the Regulation;  
3. Individuals and authorities whose right of access to Personal Data is expressly recognized by law, regulations, or orders from competent authorities;  
4. Entities acquiring the business or a business unit, companies resulting from potential mergers, demergers, or other transformations of the Data Controller’s company. 
5. Joint controllers of the Company, part of the Longevity Group, for administrative, accounting and IT management activities.

In the case that you wish to know which entities have received your Personal Data as a result of your interactions with the Data Controller, you may contact them by sending an email to the address provided below. 

PROCESSING METHODS 

The data collected will be processed by means of electronic or otherwise automated, computerized and telematic tools, or by means of manual processing with logic strictly related to the purposes for which your Personal Data was collected and, in any case, in such a way as to ensure the security of the same. Your Personal Data will be kept in a form that allows its identification for as long as is strictly necessary for the purpose for which the data was collected and in accordance with the principles of proportionality and necessity.

RETENTION PERIODS

The Personal Data, falling within the applicative scope of Article 2220 of the Civil Code, will be stored and processed as long as the contractual relationship with the Data Controller subsists and in any case for a period of 10 years from the termination of the contractual relationship itself after which it will be deleted, without prejudice to further storage of the same where necessary to comply with specific legal obligations, Authority orders, for the collection of outstanding debts and for the management of disputes, complaints and legal actions.

The retention times for some specific purposes are listed below:

1. Paragraph (a), data related to telematic traffic shall be processed: (i) for a period of twelve months from the date of disclosure for the purpose of detection and prosecution of crimes; (ii) for a period of seventy-two months for the purpose of detection and prosecution of crimes referred to in Articles 51, paragraph 3-quater, and 407, paragraph 2 (a), of the Code of Criminal Procedure;
2. Letters (b), (c), (d) and (e) data falling under Article 2220 of the Civil Code will be subject to the storage period of 10 years, the others will be checked and if unsuitable for the purpose deleted in the period of 12 months;
3. Letters (f), (g) and (h), if the data subject has given consent for marketing and profiling purposes his/her data will be processed for such purposes for 24 and 12 months;
4. Letter (i), if the data subject has given consent for food and genetic testing, the data will be retained for the period necessary to provide you with feedback on the outcome of the test and will be deleted no later than the end of the calendar year following the year in which you took the test;
5. Letter (j), if the data subject has provided a contact request such data will be retained for a maximum period of 12 months after receipt of the request;
6. Letter (k), if the data subject has given consent for the implementation of the restricted area, the data will be kept until the eventual end of the Holder’s activities through the restricted area; if you have not accessed the restricted area for at least two years, your data will be deleted;
7. Letter (l), in the event that you have submitted a spontaneous application, the Curricula received will be discarded at the end of the calendar year following the one in which they were received; if you are still interested in proposing your application to us, you will necessarily have to make a new submission.

In any case, your Personal Data will be periodically checked, not exceeding 12 months, in order to assess its relevance to the activities of the Data Controller; if, your Personal Data is no longer relevant it will be immediately deleted.

To ensure that your Personal Data is always accurate and up-to-date, and in any case relevant and complete, please notify us of any changes that have occurred to the Controller’s contact details.

TRANSFER TO THIRD COUNTRIES

Your Personal Data will be processed and stored by the Data Controller within the territory of the European Union and Switzerland. 

Therefore, all necessary precautions will be taken in order to ensure the fullest protection of your Personal Data by basing such transfer: a) on adequacy decisions of third country recipients expressed by the European Commission; b) on adequate safeguards expressed by the third party recipient pursuant to Article 46 of the Regulation; c) on the adoption of binding corporate rules, so called binding corporate rules; d) on standard contractual clauses approved by the European Commission.

In any case, the Data Subject may request more details from the Data Controller if the Personal Data provided has been processed outside the European Union, requesting evidence of the specific safeguards adopted.

FUNDAMENTAL RIGHTS OF THE DATA SUBJECT AND HOW TO EXERCISE THEM

Pursuant to Article 15 of the Regulations, you have the right to obtain from the Data Controller confirmation as to whether or not Personal Data relating to you is being processed and, if so, to obtain access to the Personal Data and the following information: (i) purposes of the processing; (ii) categories of Personal Data; (iii) categories of recipients to whom the data has been or will be disclosed; (iv) data retention period or the criteria used to determine this period.

You also have the right:

– pursuant to Article 16, to obtain from the Controller the rectification of inaccurate Personal Data concerning you, without undue delay;

-in accordance with Article 17, to obtain from the Data Controller the right to erasure of Personal Data concerning him/her;

– pursuant to Art. 18, to obtain from the Data Controller the restriction of the processing when one of the following cases occurs: a) the Data Subject disputes the accuracy of the Personal Data, for the period necessary for the Data Controller to verify the accuracy of such Personal Data; b) the processing is unlawful and the Data Subject objects to the deletion of the Personal Data and requests instead that its use be restricted: (c) although the Data Controller no longer needs it for processing purposes, the Personal Data is necessary for the Data Subject to establish, exercise, or defend a right in court; (d) the Data Subject has objected to the processing pursuant to Art. 21(1), pending verification as to whether the Data Controller’s legitimate reasons prevail over those of the Data Subject;

– pursuant to art. 20, to receive Personal Data concerning you in a structured, commonly used and machine-readable format;

– pursuant to Article 21, to object at any time to the processing of Personal Data concerning you carried out for marketing purposes (commercial communications sent by the Data Controller).

To exercise your rights, you may send an appropriate request to the following e-mail address: info@thelongevitysuite.com. We will inform you that we have received it and will follow up on your request without undue delay.

In any case, if you believe that the processing of Personal Data is contrary to the Privacy Regulations, you also have the right to lodge a complaint under Article 77 GDPR to the competent supervisory authority based on your habitual residence or the place of violation of your rights.