Privacy Policy

Information pursuant to EU Regulation 2016/679 ("GDPR")

What types of data do we collect?

When you use our services, you agree that our company collects some of your personal data. This page is intended to tell you what data we collect, why and how we use it.

We deal with two types of data:

• Data provided by the user
• Data we collect automatically

Data provided by the user

If you are a private individual

If you are a private individual, when you reply to an ad we ask you to provide us with some data that you need to use our service.

These are, for example, the data we ask you: name and surname, email and telephone number (in the contact form of the ad of a professional user). When you call a professional user, we may treat your phone number in pseudonymised form for reporting and service improvement purposes. We inform you that for some ad categories your phone number can be verified by sending a text message in order to ensure greater quality and safety of the service. As part of using the service, you can use the "Messages" and "Chat" functions to communicate with other users or with our Customer Happiness Center respectively.

Third party data

If you provide personal data of third parties, such as those of your family or friends, you must be sure that these subjects have been adequately informed and have consented to the related processing in the manner described in this statement.

Data of minors under the age of 16

If you are under the age of 16 you cannot provide us with any personal data nor can you register on Box & Paper, and in any case we do not assume responsibility for any false statements you provide. If we become aware of the existence of untruthful declarations, we will proceed with the immediate cancellation of any personal data acquired.

If you are a professional

If you are a professional, when you want to create a professional account you will be asked to provide us with some data: company name, VAT number, contact name, email address, telephone number. Other data may be required to carry out further checks on your professional activity: professional category, full address. Furthermore, we may collect and process data available and publicly accessible also in paper or electronic directories in order to promote services dedicated to your professional activity. In this case, during the contact phase, you will be given references to this information, as well as you can object at any time to the processing of data in the manner indicated in the following point 4.

Data we collect automatically

We collect the following data through the services you use:

• technical data: for example IP address, browser type, information on your computer, data relating to the current (approximate) position of the instrument you are using;
• data collected using cookies or similar technologies: for more information, please visit the "Cookies" section.

How do we use the collected data?

We use the data collected to offer you our service every day, to inform you about our commercial activities or to offer you a more personalized service in line with your interests.

1. To guarantee you access to our services and improve their provision: we use your data to guarantee access to our services and their provision, including: registration and creation of the reserved area, publication of ads, use of features " favorites ”and“ saved searches ”, communications connected to the provision of the service, messaging between users (Messages). These treatments are necessary to correctly provide Box & Paper services to users who join them. We also use your data to ensure a better service and implement it, through the following treatments: assistance through the Customer Happiness Center, also through the Chat function, data analysis in aggregate form, review of ads, moderation or removal of content, prevention of fraud, activities of an administrative, financial or accounting nature, such as those relating to the purchase of optional paid services and possible credit recovery, detection of your current (approximate) position to facilitate the use of some functions of the service, such as for example the display of advertisements from stores close to you, communications relating to services similar to those used by you, market research,
2. Optional surveys and activities for detecting the degree of user satisfaction: these treatments are based on the legitimate interest of the Data Controller in improving the service and its implementation and you can object, in the cases provided for by law, at any time.
3. To inform you about our commercial activities: we use the collected data, if you have expressly given us your consent, to inform you about promotional activities that may interest you. In particular, we use them to: notify you of promotional, commercial and advertising activities on Box & Paper events, initiatives or partnerships, by e-mail, sending SMS or push notifications; only if you are a professional, for telephone calls through an operator, a customer care service consisting in the offer of dedicated services in the sales and after-sales areas, to carry out analysis and reporting activities connected to promotional communication systems, such as detection the number of open e-mails, clicks made on the links present in the communication, the type of device used to read the communication and its operating system or the list of subscribers to the newsletter.
4. To offer you a personalized service: we process the collected data, if you have expressly given your consent, to analyze your habits or consumption choices in order to offer you an increasingly personalized service in line with your interests and to improve our commercial offer. In any case, these analyzes are not related to an automated decision-making process.

Is the provision of data mandatory?

The provision of personal data is mandatory only for the processing necessary for the provision of the services offered by Box & Paper (any refusal for the purpose of providing the service makes it impossible to use the service itself); it is optional for promotional and profiling purposes and any refusal to give consent does not have negative consequences on the provision of the service offered within the website www.boxandpaper.com and related applications.

Who are the subjects of the treatment?

1. Data controller: The data controller is Box and Paper Srl in the person of its pro-tempore legal representative, with registered office located in Rome (IT), 00197, Via A. Caroncini 4. The data controller uses data processors to achieve the purposes specified in point 1 and a Data Protection Officer (DPO) to monitor the protection of personal data. For each request relating to your personal data, compare point 2 below.
2. Data Protection Officer (DPO) and contact information: The person in charge of the protection of personal data (Data Protection Officer) pursuant to art. 37 of the GDPR is Avv. Daniel Pavoncello. We remind you that you can contact the DPO at any time and send any question or request relating to your personal data and respect for your privacy by writing to commerciale@boxandpaper.com.
3. Subjects to whom personal data may be communicated: the data collected as part of the service provision may be communicated to: companies that perform functions strictly connected and instrumental to the operation - including technical - of the Box & Paper services, such as suppliers who provide services aimed at the review and verification of advertisements, direct marketing and customer care service providers, companies that provide archiving, administrative, payment and billing services, administrative and judicial bodies and authorities by virtue of legal obligations. Your personal data may be transferred outside the European Union to be processed by some of our service providers. In this case, we make sure that this transfer takes place in compliance with current legislation and that an adequate level of protection of personal data is guaranteed based on an adequacy decision, on standard clauses defined by the European Commission or on Binding Corporate Rules.

How can you get information on the data, modify it, delete it or have a copy?

1. Access to personal data from your reserved area and withdrawal of consent (opt-out): you can, at any time, view your data and any information provided for billing in your reserved area. Log into your account and click the "Reserved Area" section. Remember that you can revoke the consents you have provided at any time by accessing your reserved area and removing the relative flag.
2. Export and deletion of personal data: to export your personal data (takeout) or request its deletion, you can send a request to the email address commerciale@boxandpaper.com from the email box with which you registered. Your personal data will be exported within 30 days or, if the export becomes particularly complex, within three months. The cancellation will be carried out within the expected technical times and in accordance with the retention period specified in the following section.
3. Exercise of your rights: any natural person who uses our service can:
   • Obtain from the owner, at any time, information about the existence of their personal data, the origin of the same, the purposes and methods of treatment and, if present, to obtain access to personal data and information referred to in 'article 15 of the GDPR.
   • Request the updating, rectification, integration, cancellation, limitation of data processing in the event that one of the conditions provided for in Article 18 of the GDPR is met, the transformation into anonymous form or the blocking of personal data, processed in violation of law, including those that do not need to be kept for the purposes for which the data were collected and / or subsequently processed.
   • To object, in whole or in part, for legitimate reasons and in accordance with the law, to the processing of data, even if pertinent to the purpose of the collection and to the processing of personal data provided for the purposes of commercial information or sending advertising or sales material direct or for carrying out market research or commercial communication. Each user also has the right to withdraw consent at any time without prejudice to the lawfulness of the processing based on the consent given prior to the withdrawal.
   • Receive your personal data, processed on the basis of a contract or on the consent of the interested party, provided knowingly and actively or through the use of the service, in a structured format, commonly used and readable by automatic device, and to transmit them to another holder of the treatment without hindrance.
   • File a complaint with the Italian Data Protection Authority.We remind you that for any question or request relating to your personal data and respect for your privacy, you can write to commerciale@boxandpaper.com

How and for how long will your data be stored?

The storage of personal data will take place in paper and / or electronic / computer form and for the time strictly necessary to fulfill the purposes referred to in point 1, in compliance with your privacy and current regulations. For direct marketing and profiling purposes we process your data, according to the consent you have provided, for a maximum period equal to that provided for by the applicable legislation (respectively equal to 24 and 12 months). For the purpose of developing and improving the service and related functions, the personal data of the active user may be analyzed and stored in aggregate and pseudo-anonymized form for up to 36 months. These data are confidential and for internal use only.

For the same purposes and greater security of the service through moderation and prevention of conduct contrary to the conditions and editorial rules of Box & Paper - also in collaboration with the Authorities - the advertisements, the contents generated by professional users on the platform and those relating to the its identification (with the exception of requests for assistance to Customer Service, whose conservation follows the user's life cycle) will in any case be kept by the owner, in a protected form and with limited access, for a period of 36 months . These confidential contents will be for internal use only and may be provided by the owner only to the Judicial Authority or to the user's defender for legal purposes. Invoices, accounting documents and transaction data are kept for 11 years in accordance with the law (including tax obligations).

In the case of exercising the right to be forgotten through a request for express cancellation of the personal data processed by the owner, we remind you that such data will be kept, in a protected form and with limited access, only for the purpose of ascertaining and prosecuting crimes, for a period not exceeding 12 months from the date of the request (except as indicated above regarding the data used for the purposes of moderation and prevention) and subsequently they will be securely deleted or irreversibly anonymised. Finally, we remind you that for the same purposes, the data relating to the electronic traffic of active users, excluding the contents of the communications, will be kept for a period not exceeding 6 years from the date of communication.

How do we ensure the protection of your data?

The data are collected by the subjects indicated in point 3, according to the indications of the reference legislation, with particular regard to the security measures provided for by the GDPR (Article 32) for their processing by means of computerized, manual and automated tools and with strictly related logics. for the purposes indicated in point 1 and in any case in order to guarantee the security and confidentiality of the data. In compliance with the applicable legislation, an antispam verification system is active on communications between users. The data entered therein may be verified for the sole purpose of identifying illegal activities or contents that do not comply with the General Conditions of the Service, but will not be processed or communicated for commercial or promotional purposes.

Social network

The data controller makes available its social channels (eg Facebook, Twitter, Whatsapp etc.) to allow users to express their opinions and receive assistance regarding the services offered. Personal data is processed according to the privacy policy of the reference social networks as well as the Box & Paper privacy policy, always available on our official pages.