G. Data Relating to Minors

The Personal Data of minors under the age of 18 shall not be processed by the Data Controller unless prior authorization is obtained from the holder of parental responsibility.

H. Who Has Access to Personal Data and with Whom Is It Shared?

Your Personal Data may be disclosed to specific parties considered recipients of such Personal Data (hereinafter referred to as “Recipients”).

To properly carry out all processing activities necessary to pursue the purposes outlined in this Privacy Policy, the following Recipients may be in a position to process your Personal Data:

• Third parties who perform part of the processing activities and/or activities related and instrumental to them on behalf of the Data Controller (such as the management of the IT system). Third parties that process data on our behalf and under our authority have been adequately selected and are experienced, capable, and reliable, providing suitable guarantees of full compliance with applicable data protection regulations, including data security aspects. We periodically verify that the Data Processors fulfill their assigned tasks and continue to provide suitable guarantees of full compliance with data protection regulations.

• Individual employees and/or collaborators of the Data Controller who have been entrusted with specific and/or multiple processing activities regarding your Personal Data. These individuals have been given specific instructions regarding the security and proper use of Personal Data.

• Third-party providers of the ChatBot service: we share certain information provided by users interacting with our ChatBot with OpenAI in order to generate and respond to user inquiries in a personalized manner. The information and data shared with OpenAI will not use the information contained in the chat to train its own model.

• Personal Data and information provided by users are shared with our partners and affiliates (“Partners”) if the user intends to proceed with the purchase of products selected among those indicated by Ubique or simply wishes to receive personalized and real-time assistance. In such cases, further processing and use of the data we receive are governed by the privacy policies of our Partners and are not under our control.

• Where required by law or to prevent or repress the commission of a crime, your Personal Data may be disclosed to public authorities or judicial authorities.

A detailed and updated list of such parties, as well as those acting as data processors, can be easily obtained by sending an email to:      contact@ubiquefashion.com

I. How Do We Process Personal Data and How Long Do We Retain It?

The processing of data is carried out with or without the aid of electronic, automated, IT, or telematic tools, using logic strictly related to the purposes expressed above. Data processing will be conducted lawfully and fairly and in accordance with the aforementioned regulations, using suitable tools to ensure security and confidentiality, and may also be conducted through automated means for storing, managing, and transmitting the data.

In processing data that may directly or indirectly identify you, we strive to adhere to a principle of strict necessity. Therefore, we have configured the App so that the use of your Personal Data is minimized: consequently, the processing of your data is excluded when the purposes pursued in individual cases can be achieved by using anonymous data (such as, for example, analyses aimed at improving services) or through other means that allow identification of the Data Subject only when necessary or at the request of authorities and law enforcement (such as, for example, data related to traffic, your activity within the App, or your IP address).

Your Personal Data will be processed for a period equal to the minimum necessary to achieve the purposes for which the data are collected, subject to any further retention period imposed by legal provisions, and will be deleted without undue delay.

User registration: we retain data until a request for unsubscription from the App is made. In the event of inactivity for more than      2 years, the account will be removed and the user will need to proceed with a new registration.

For purposes for which user consent is required, we will process the data until consent is revoked.

For more information on the retention of data collected via cookies, please refer to the Cookies Policy.

Your data will be retained for an additional period concerning purposes of disputes and any legal obligations.

J. Can We Transfer Personal Data to Third Countries or International Organizations?

Your Personal Data will be processed by the Data Controller within the territory of the European Union.

Should it become necessary for technical and/or operational reasons to engage parties located outside the European Union, we hereby inform you that such parties will be appointed as Data Processors pursuant to Article 28 of the Regulation, and the transfer of your Personal Data to such parties, limited to the performance of specific processing activities, will be governed in accordance with the provisions of Chapter V of the Regulation. All necessary precautions will be taken to ensure the utmost protection of your Personal Data by basing such transfer on: (a) adequacy decisions regarding third countries issued by the European Commission; (b) adequate safeguards provided by the third-party recipient under Article 46 of the Regulation; (c) the adoption of binding corporate rules.

Personal Data may be transferred to the USA for storage on servers, subject to the execution of standard contractual clauses with the server and/or third-party service providers.

In any case, you may request further details from the Data Controller if your Personal Data has been processed outside the European Union by requesting evidence of the specific safeguards adopted.

K. How Is the Security of Personal Data Guaranteed?

We adopt appropriate security measures to minimize the risks of destruction or loss—also accidental—of data, unauthorized access, or processing that is not permitted or non-compliant with the purposes of collection indicated in our Privacy Policy.

The transfer, storage, and processing of your data collected through the App are ensured through suitable technical measures. However, we cannot guarantee users that the measures taken for the security of the App and the transmission of data and information on the App limit or exclude any risk of unauthorized access or data leakage from user-owned devices: we recommend ensuring that your computer is equipped with appropriate software to protect the transmission of data over the network, both incoming and outgoing (such as up-to-date antivirus systems) and that your Internet service provider has implemented suitable measures for data transmission security over the network (such as firewalls and anti-spam filters).

L. What Rights Can You Exercise and How?

As provided by Article 15 of the Regulation, you have the right to access your Personal Data, request their rectification and updating if incomplete or inaccurate, request their deletion if the collection occurred in violation of law or regulation, and oppose the processing for legitimate and specific reasons.

In particular, we outline below all your rights that you may exercise at any time against the Data Controller:

• Right of Access: You have the right, under Article 15 of the Regulation, to obtain from the Data Controller confirmation of whether or not your Personal Data is being processed and, if so, to access such Personal Data and the following information: a) the purposes of the processing; b) the categories of Personal Data concerned; c) the Recipients or categories of Recipients to whom your Personal Data has been or will be disclosed, especially if Recipients are in third countries or international organizations; d) where possible, the retention period for the Personal Data or, if not possible, the criteria used to determine that period; e) the existence of the right of the Data Subject to request the Data Controller to rectify or delete Personal Data or restrict the processing of Personal Data concerning them or to object to their processing; f) the right to lodge a complaint with a supervisory authority; g) where Personal Data is not collected from the Data Subject, all available information about their source; h) the existence of automated decision-making, including profiling as referred to in Article 22, paragraphs 1 and 4 of the Regulation, and at least in such cases, meaningful information about the logic involved, as well as the significance and consequences of such processing for the Data Subject.

All this information can be found within this Privacy Policy, which will always be available to you in the Privacy section of the App.

• Right of Rectification: You may obtain, under Article 16 of the Regulation, the rectification of your Personal Data that is inaccurate. Taking into account the purposes of the processing, you may also obtain the completion of your Personal Data that is incomplete, including by providing a supplementary statement.

• Right to Deletion: You may obtain, under Article 17 of the Regulation, the deletion of your Personal Data without undue delay, and the Data Controller shall be obliged to delete your Personal Data if one of the following grounds applies: a) Personal Data is no longer necessary for the purposes for which it was collected or otherwise processed; b) you have revoked the consent on which the processing of your Personal Data is based, and there is no other legal basis for processing; c) you have objected to the processing pursuant to Article 21, paragraphs 1 or 2 of the Regulation, and there are no overriding legitimate grounds for continuing the processing of your Personal Data; d) your Personal Data has been unlawfully processed; e) it is necessary to delete your Personal Data to comply with a legal obligation provided for by EU law or national law.

In certain cases, as provided in Article 17, paragraph 3 of the Regulation, the Data Controller is entitled not to delete your Personal Data if its processing is necessary, for example, for the exercise of the right to freedom of expression and information, for compliance with a legal obligation, for public interest reasons, for archiving in the public interest, for scientific or historical research purposes, or for statistical purposes, for the establishment, exercise, or defense of a legal claim.

• Right to Data Portability: You may request and receive, at any time, your Personal Data processed by the Data Controller in a structured, commonly used, and machine-readable format, pursuant to Article 20 of the Regulation. You may also request the transmission of your Personal Data to another data controller without hindrance. In this case, you are responsible for providing us with all the accurate details of the new data controller to whom you intend to transfer your Personal Data, along with written authorization.

• Right to Object: Under Article 21 of the Regulation, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your Personal Data, including profiling. You may also object at any time to the processing of your Personal Data when it is processed for direct marketing purposes, including profiling to the extent that it is related to such direct marketing. In such cases, we will refrain from further processing your Personal Data unless there are compelling legitimate grounds for processing that override your interests, rights, and freedoms or for the establishment, exercise, or defense of a legal claim.

• Withdrawal of Consent: If you have provided your consent to the processing of your Personal Data for one or more specific purposes, you may withdraw your consent at any time, either wholly or in part, without affecting the lawfulness of the processing based on your consent before its withdrawal.

How to Exercise Your Rights:
You may exercise your rights at any time by sending an email to: contact@ubiquefashion.com.
Please note that, when exercising your rights, we may ask you to verify your identity before proceeding with your request.

A form for exercising rights under data protection law is available here and can be used to submit your request.

According to the Regulation, the Data Controller is not authorized to charge fees for fulfilling any of the requests made in this paragraph, unless they are manifestly unfounded or excessive, particularly if they are repetitive. In cases where the user requests more than one copy of their Personal Data or in cases of excessive or unfounded requests, Ubique may (i) charge a reasonable fee, taking into account the administrative costs incurred in fulfilling the request, or (ii) refuse to comply with the request. In such cases, Ubique will inform the user of the costs before processing the request.

M. Can Complaints Be Made?

You have the right to lodge a complaint with the Italian Supervisory Authority if necessary, or to contact them for information regarding the exercise of your rights. Without prejudice to any other administrative or judicial remedy, you have the right to file a complaint with the Italian Supervisory Authority if you believe that the processing concerning you is carried out in violation of the Regulation. Further information is available on the website www.garanteprivacy.it.

In any case, Ubique is interested in being informed of any reasons for complaints and encourages users to use the contact channels mentioned above before approaching the Supervisory Authority, so as to prevent and resolve any disputes amicably and promptly, with the utmost courtesy, seriousness, and discretion.

N. Updates

We reserve the right to review, modify, or simply update, in whole or in part, in any manner and/or at any time, without notice, this Privacy Policy, also in light of changes to laws or regulations concerning data protection, indicating at the bottom of the webpage the date of the last update. Changes and updates will be notified via the App at the first access following the modification and will be binding as soon as they are published.