1. Introduction
This Privacy Notice describes the way we treat all the personal data you provide or that we have obtained through our E23 Delivery Websites and Applications and in our Stores. .
Summary of provisions:
Controller of Personal Data, Sources of Personal Data and What Personal information about Customers do E23 Delivery Websites and Applications collect?
Lawful Purposes for Processing and collecting Personal Data
Sharing your Personal Data
Storing your Personal Data
Security of Personal Data
Transfer of Data Outside of your Country
Retention of Personal Data
Minors
What Are Your Rights?
What Are Your Choices?
Changes to Our Privacy Statement
Where to make a Data Protection complaint?
2. Controller of Personal Data, Sources of Personal Data and What Personal Information about Customers do E23 Delivery Websites and Applications collect?
(a) Controller and Processors of Personal Data
E23 Delivery Srl who is the owner of website (as set out in the terms) which you are currently visiting is the controller of the personal data that you (as data subject) provide us or we received in our Stores and E23 Delivery Websites and Applications.
(b) Types of Personal Data collected and Sources of Personal Data
We collect personal data directly from our customers through E23 Delivery Websites and Applications and our Stores. We collect the following types of personal data about you from the following sources:
Information that you provide to us:
We receive and store any information you enter on E23 Delivery Websites and Applications and Stores or give us in any other way such as during registration, accessing your account or profile, submitting queries or as part of a survey or competition or utilising gift coupons or customer support or communicate with us or purchasing online or using our products or services.
Due to such actions, you may supply us with your (i) name, postal address, email address, phone numbers, (ii) data necessary to process your online payment (including the credit card/payment instrument information and
personal security code associated with your credit card) for online purchases (under the E23 Delivery Airport Quick Commerce Websites), to apply for a refund, or to communicate
with customer services regarding a refund to the credit card/payment instrument, (iii) flight departure/destination, flight date and delivery address for the subscriber and airport location to pick up any Airport Quick Commerce products ordered online or purchased. Demographical data such as your age, gender, country, nationality, preferred language, passport number and citizenship, date of birth, country of residence, country of registration to E23 Delivery Websites and Applications, purchases history and other travel information including travel date, preferred departure airport and airline loyalty membership details
could be also collected. You must hold a valid flight ticket to be able to make duty free or duty paid purchases from E23 Delivery . Such information is collected through our Airport Quick Commerce Website to meet our contractual obligations with airport authorities, airport retailers and legal obligations towards customs and other regulatory authorities.
When you register for membership, subscribe for services or the newsletter or other marketing communications including blogs or customer comments or use the E23 Delivery Websites and Applications or purchase online in our Airport Quick Commerce, we
collect log in details, passwords, any password questions and hints, similar security information used for authentication and account access is also collected for the access into your personal account and profile and to utilise the Airport Quick Commerce elements of E23 Delivery Websites and Applications.
You can choose not to provide certain information, but then you might not be able to utilise many of the features of the E23 Delivery Websites and Applications. See What Are Your Choices section below.
Information collected automatically through interaction with us:
We receive and store information where you interact with us through using our products and services, including online technologies (ie Cookies) and receiving error reports or usage data from software applications on your devices online or via WiFi communications in the Airports where we operate. We collect and analyse device, connectivity and configuration data including the Internet protocol (IP) address used to connect your computer or device to the internet, computer and connection information such as browser type, version, time zone and other computer software installed on the device, browser plug in types and versions, operating system, shopping preferences, wish list, purchase history, the features you use and pages accessed and web sites visited.
We also collect the Uniform Resource Locator (URL) clickstream to and from our E23 Delivery Websites and Applications, including date and time, cookie number, products viewed and searched for and the phone number used to contact our customer support teams. We collect technical information to help us identify your device for fraud prevention and diagnostic purposes such as any problems to the product and settings, error reports including data as to the type and severity of the problem, details of software and hardware related to an error, contents of files you were using when an error occurred and data about other software on the device. We collect browser data including persistent and session cookies and other online technologies as set out below in the Online Technologies section below. We utilise software tools to measure and collect the performance data on E23 Delivery Websites and Applications including download error or performance
issues caused.
Most browsers allow you to opt out of cookies or turn on “do not track”. For more information, see What are Your Choices section below.
Mobile or E23 Delivery Applications:
When you choose to use or download E23 Delivery Websites and Applications or allow
connectivity via WiFi connections to your device, we receive information about your location and mobile device, including a unique identifier for your personalised device, your GPS data or wireless networks data (WLAN). Location data is neither stored nor transmitted to third parties. If you agree with the localisation function, we can provide you with location-based services including advertising, search results and personalised content.
When you are near one of our partner airport retailers, then we can push email communications to you if you have provided your consent to receive such communications and advertising. Most mobile devices allow you to turn off location services. For more information, see What are Your Choices section below.
E-Mail Communications:
To provide more personalised and interesting email communications, we receive a
confirmation when you open email from E23 Delivery Websites and Applications or your device is near one of our Airport Partner Store if your computer or device supports this capability and if you have agreed with the localisation function though
your device. If you choose not to receive any emails or other mail from us, please adjust your customer communication preferences in your account profile.
3. Lawful basis and purposes for processing and using your personal data
(a) Lawful purposes
Your personal data is processed by E23 Delivery on the basis of a lawful “justification” for such processing, to the extent required by law. In the majority of cases, the processing of your personal data will be justified on one of the following bases:
(a) It is provided for in your contract of providing products and services ordered online by you to be provided by us;
(b) It is necessary for us to comply with a legal obligation;
(c) It is with your freely provided unequivocal and informed consent for specified processing purposes;
(d) It is necessary to protect your or someone else’s life; or
(e) It is in our legitimate interests as a business and as your supplier of contractually ordered goods, and our interests are not overridden by your interests, fundamental rights or freedoms including legitimate interests as set out below.
The processing of personal data relating to actual, alleged or suspected criminal offences and convictions will be justified by one of the above bases and normally one of the following special conditions:
(a) It is necessary for the purposes of preventing or detecting crime or other unlawful acts;
(b) It is necessary to protect the public against dishonesty; or
(c) We have obtained consent from the relevant individuals involved for the processing.
(b) Purposes of processing personal data
We obtain, use, disclose and otherwise process personal data about customers, based on the execution of a contract to:
(i)
process online transactions they request, including Airport quick commerce selection and
mobile transactions;
(ii)
process information to review and collect data from the boarding pass, nationality, destination and holder of the valid boarding pass to ensure that the passenger is part of the travelling public to allow E23 Delivery to sell duty free goods under the terms of the contractual agreement with our Airport Retailers or airport authorities;
(iii)
(iv)
(v)
Provide online payment services including credit cards for online purchases
protect the log in details of the subscribers and system integrity of the E23 Delivery Websites and Applications;
(vi)
(vii)
(viii)
to carry out your contractual transactions with us and to provide the airport retailers products available in our quick commerce (including the online order of duty free products listed in the Airport Quick Commerce website for Pick up at the requested Airport where we operate) to you as requested by you. This includes using your personal information to register or subscribe to any services provided thorough E23 Delivery Websites and
Applications; fulfil our legal obligations; we collect personal data especially the following:
passenger name, flight number, boarding card to ensure that the consumer reserving the products is a valid traveller to meet our contractual obligations to the Airport regulations
as well to allow the calculation of the VAT or similar tax allowances to be calculated for give you the correct price of your online purchase and analytics purposes; protect the rights or property or safety of E23 Delivery Websites and Applications or Stores, including our
customers and visitors; and
(ix)
(x)
assist third parties including the police, tribunals, courts, regulators, airports or other authorities with their investigations or requests or to report security incidents or suspected or actual unlawful acts. This assistance is provided for the purposes of preventing or detecting unlawful acts, the apprehension or prosecution of offenders, protecting the safety of our customers or in connection with other lawful requests to disclose personal data that we received from or make to third parties (for example missing persons investigations).
Where we process your personal data on the basis of our legitimate interests, those will be our interests in:
Providing and improving the services we offer and perform essential business operations. This includes operating the services, maintaining and improving the performance of the service, developing new features, conducting research and providing customer support;
Protecting the security and safety of our products and our customers, to detect and prevent unlawful acts including fraud and to confirm the validity of the subscriber logging into E23 Delivery Websites and Applications;
Using personal data for statistical and analytical purposes. Whenever reasonably possible we will anonymize such information before using it for statistical or analytical purposes. Such information is processed in the legitimate interests of E23 Delivery SRL to maintain the efficiency, relevancy and availability of the E23 Delivery Websites and Applications;
Effective management and operation of E23 Delivery; to maintain our business relationship, where you are a user or subscriber of our E23 Delivery Websites and Applications;
improve E23 Delivery Websites and Applications, quality of service and customers online shopping experience;
Advertising : Sending you communications regarding shopping opportunities, products, services, campaigns, special offers promotions, contests and customer surveys, newsletters related to E23 Delivery Websites and Applications to provide invitations to attend events;
to commence, protect or defend E23 Delivery in actual or threatened legal proceedings.
4. Sharing your Personal Data
We will not transfer or disclose your personal information, other than as set out below:
(a) Effective management and operation of E23 Delivery, and only when certain services are centralised;
(b) to third party service providers (companies or individuals) that we employ to perform functions on our behalf such as fulfilling orders, delivering to Airport available pick up areas, sending postal mail and email, removing repetitive information from customer lists, analysing data, providing marketing assistance, providing search results and links, processing credit card payments and providing customer service. These providers have access to personal information needed to perform their functions, but may not use it for other purposes and include the following categories of data recipients:
(i) providers of payment services;
(ii) website developers;
(iii) cloud computing service providers;
(iv) electronic storage providers;
(v) airport couriers and logistics partners;
(vi) airport retailers and duty free operators.
(vii) airport management companies
(c) in releasing account and other personal data to comply with the law, undertaking litigation or other proceedings or to enforce or comply with or apply our terms of use and other agreements, or protect the rights, property or safety of E23 Delivery Websites and Applications or Stores. This includes exchanging information with other companies for fraud prevention and credit risk reduction;
(d) to comply with legal or regulatory requirements or obligations in accordance with applicable law, a court order or a subpoena;
(e) with regulatory authorities, airport authorities, E23 Delivery and concessions partners
and customs and tax authorities;
(f) in an emergency, such as to safeguard the life, health, or property of an individual; or
(g) to third parties including the police, tribunals, courts, regulators, airports or other authorities to assist them with their investigations or requests or for us to report security incidents or suspected or actual unlawful acts.
5. Storing your Personal Data
Your personal information you have provided to the controller will be located in a E23 Delivery cloud based CMS database software tool located within Amazon data centres maintained in the territories of the EEA, the purpose of which is to manage the business relationship with you, in accordance with the provisions of the data protection laws.
E23 Delivery will manage the customer relationship with you and any marketing materials can be provided by E23 Delivery as Controller.
6. Security of personal data
Your personal data will be secured by taking security measures that are commensurate with the sensitivity of the personal data processed. To this end, E23 Delivery maintain appropriate physical, technical, and administrative security measures with a view to protecting personal data against theft; accidental loss; unauthorised alteration; unauthorised or accidental access, processing, erasure, use, disclosure or copying;
and/or accidental or unlawful destruction.
When we have provided (or you have chosen) a password allowing access to certain areas of the E23 Delivery Websites and Applications, you are responsible for safeguarding it and keeping it confidential and you undertake not to allow it to be used by third parties. Unfortunately, the transmission of information through the internet is not completely secure. Although we will take all reasonable commercial measures to protect your personal
data, we cannot guarantee the security of any personal information or data you disclose on line. You accept the inherent security implications of using the internet and to the extent permitted by law, we will not be responsible for any breach of security, unless we have been acting with gross negligence and only within the limitations as set out in the terms and conditions of use for E23 Delivery Websites and Applications.
7. Transfer of Data Outside of Your Country
Your personal data (as described above) may be transferred to third parties described above, only to the extent required for E23 Delivery to perform their obligations to you, or for
you can access your E23 Delivery Websites and Applications, or for the purposes described above in this Notice, provided such purposes are in accordance with applicable laws. In particular:
Your profile and contact information contained in systems such as corporate communications systems,
customer relationship management databases or directories will be accessible to all marketing, sales and customer support or customer care employees of E23 Delivery
Your personal data may be transferred to or accessed by employees located inside or outside your country, and/or a person or company that is not part of the company located in or outside your country, on a need-to-know basis. Transfers outside the EU may be made pursuant to the European Commission's Standard Contractual Clauses ("SCC"), the EU-U.S. Privacy Shield certification or other legally acceptable mechanisms which ensure an adequate level of protection. As permitted by law, you may be entitled, upon request to the Global Data Protection Co-ordinator, to be informed about the appropriate safeguards that have been taken to protect your Personal Data for transfer outside the EU.
E23 Delivery AG may process your personal data as a controller in order to administer and provide you with products and services that you requested, to administer global sales and customer programs, promotional and marketing activities and surveys, competitions and coupon and gift promotions, communications with customers, advertising campaigns with us, to manage sales and customer relationships and to prepare sales and customer relationship management and customer support reporting, consistent with the terms of this Notice. E23 Delivery SRL is located in Italy, a country that benefits from an adequacy decision of the European Commission that has found Italian law to afford adequate protection to personal data.
Transfers may be made to respond to law enforcement requests or discovery procedures, or where required or permitted by applicable laws, court orders, government regulations, or government authorities (including tax and employment). Such transfers may entail access by courts or governmental authorities outside your country, after having ensured that only your minimal necessary data is disclosed and transferred, or that such data is de-identified or that, where possible, appropriate stipulative court orders have been issued. A list of the countries located outside the EU to which your Personal Data may be transferred, and an indication of whether they have been determined by the European Commission to grant adequate protection to Personal Data, can be found at https://ec.europa.eu/info/strategy/justice-and-fundamental-rights/data-protection/data-transfers-outside-eu_en.
Transfers of Personal Data in accordance with this Section 7 are based on the same legal bases as applicable for the respective purposes of processing as set out above.
8. Retention of personal data
E23 Delivery data retention policy requires that personal data be retained for no longer than required to fulfil the purposes for which it was collected. In general, personal data, or records containing personal data, will be retained for periods of time required in accordance with applicable legal, tax, or accounting obligations. In specific circumstances, and in accordance with applicable law, E23 Delivery may retain your personal data for longer periods of time (such as for the duration of the relevant statute of limitation) so that we have an accurate record of our dealings with you or to protect the legitimate interests of E23 Delivery or local E23 Delivery entity name, who owns this E23 Delivery Website or Application. In all cases, where your information is no longer required, E23 Delivery will ensure it is disposed of in a secure manner.
9. Minors
E23 Delivery Websites and Applications do not provide products and services to children. Whilst we may sell toys and confectionery which may appeal to children, any reservation for our products and services can only be provided to adults over the age of 18 years old. We do not knowingly collect personal information from children under the
age of 18 years, without the consent of the child’s parent or guardian. Accordingly, the parent will need to complete and submit a fully completed and signed Parental Personal Data Consent Form along with evidence of the person’s identity, to the email address: privacy@e23delivery.com
10. What are your rights?
You have the right under applicable law to access, obtain a copy and correct personal data concerning you, subject to limited exceptions that may be prescribed by applicable laws. Where justified and mandated by applicable law, you may also require that your personal data be deleted or blocked, or you may be entitled to obtain information about the processing of your data, or object to further processing of your data.
In the event your personal data is processed on the basis of your consent, you have the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. You can do this by (i) in some cases deleting the relevant Personal Data from the relevant IT system (although note that in this case it may remain in back-ups and linked systems until it is deleted in accordance with our data retention
policy) or (ii) contacting your Global Data Protection Coordinator. You also have the right to be informed about how your personal data is handled and from whom we receive
your data. As permitted by law, you also have the following additional rights:
Data portability - where we are relying upon your consent or the fact that the processing is necessary for the performance of a contract to which you are party as the legal basis for processing, and that personal data is processed by automatic means, you have the right to receive all such personal data which you have provided to E23 Delivery or local entities of E23 Delivery in a structured, commonly used and machine-readable format, and also to require us to transmit it to another controller where this is technically feasible.
Right to restriction of processing - you have the right to restrict our processing of your personal data
where:
you contest the accuracy of the personal data until we have taken sufficient steps to correct or
verify its accuracy;
where the processing is unlawful but you do not want us to erase the personal data;
where we no longer need your personal data for the purposes of the processing, but you require such personal data for the establishment, exercise or defence of legal claims; or
where you have objected to processing based on legitimate interest from E23 Delivery (see below) and pending verification as to whether E23 Delivery or locat entities have compelling legitimate grounds to continue processing.
Where your personal data is subject to restriction in this way we will only process it with your consent or for the establishment, exercise or defence of legal claims.
Right to object to processing justified on legitimate interest grounds where we are relying upon legitimate interest to process personal data, then you have the right to object to that processing. If you object, we must stop that processing unless we can either demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms or where we need to process the personal data for the establishment, exercise or defence of legal claims. Where we rely upon legitimate interest as a basis for processing we believe that we can demonstrate such compelling legitimate grounds, but we will consider each case on an individual basis.
Right to object to processing for marketing purposes – you have the right to object to any processing of your data for marketing purposes (including profiling). Additionally, see What are Your Choices?
11. What are Your Choices ?
E23 Delivery Websites and Applications provide you with access to a range of information about your account and your interactions with us. To ensure that your personal data is accurate and up to date, we encourage you to regularly review and update your information as appropriate, if your contact details or address has changed. If you have subscribed to E23 Delivery Websites and Applications, especially E23 Delivery application or the
Airport Quick Commerce websites, then you can either access your account and make the changes or request the changes are made by sending an email request along with evidence of your identity to privacy@e23delivery.com
We like to inform you about the products and services and those of our partners and to also send you surveys, promotional materials and invitations to events, to participate in competitions or receive coupons or gift certificates as well as communications on your birthday or other special events.
If you choose not to receive such communications or modify what method of communications such as SMS, email, letter or phone we use to contact you or you choose not to agree to the use of cookies or other on line technologies, then you to opt
out of such activities by submitting the opt out provision which is the unsubscribe link to the website to allow the customer to unsubscribe (if an electronic communication), or for all other non-electronic communications, by submitting an objection email or letter to specify your preferences to privacy@e23delivery.com. You can change
your preferences or choices at any time or provide a new consent to such activities by providing a signed consent form consenting to the use of cookies, advertising materials or preferred method of communication to privacy@e23delivery.com
12. Changes to our Privacy Notice
Changes and amendments to the terms of this Privacy Notice can be made at any time and shall apply as soon as they are published on any E23 Delivery Websites and Applications. Should you not agree to any changes or amendments, then you should refrain from continuing to use our services or products or access E23 Delivery Websites
and Applications.
13. Where to make a Data Protection complaint?
You have the right to lodge complaints pertaining to the processing of your personal data with the relevant data protection supervisory authority.