Mamma 2.0 s.r.l. with registered offices in via Dogana No. 3, 20123 – Milan (Italy), Tax Code/VAT No. . 08624410968 (hereinafter, the “Data Controller“), owner of the website www.mukako.com, (hereinafter, the “Website“) in its capacity as Controller of personal data of the users who browse and are registered on the Website (hereinafter the “Users“) hereby provides the following privacy policy according to Article 13 of EU Regulation 2016/679 dated 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter, the “Regulation” and/or “Applicable Regulation“).

This Website and the services eventually offered through the Website are reserved to subjects over the age of 18 years old. Hereby, the Data Controller does not collect personal data pertaining to subjects under the age of 18 years old. At request of the Users, the Data Controller will promptly delete all the personal data, involuntary collected, pertaining to subjects under the age of 18 years old.

The Data Controller takes the outmost account to the privacy rights and to the protection of its Users’ personal data. For any information in relation to this privacy policy at any time whatsoever, the Users may contact the Data Controller using the following modalities:

• Sending a registered letter to the registered office of the Data Controller: Via Dogana No. 3 – 20123 Milan (Italy)
• Sending an e-mail to: mamma2.0srl@legalmail.it

The Data Controller has not identified a Data Protection Officer (RPD or DPO), as it is not subject to the obligation of designation provided for by Article 37 of the Regulation.

1. Purposes of data processing

Users’ personal data will be processed by the Data Controller lawfully pursuant to art. 6 of the Regulation for the following processing purposes:

1. executing the User’s request: the personal data of the Users will be processed by the Data Controller with the only purpose to reply to their queries. The Data Controller will collect the following personal data in order to be able to reply to the User’s request: the name, the email address, and any other information relating to the User voluntary given by the User to the Data Controller. No other processing will be carried out by the Data Controller in relation to the Users’ personal data. Without prejudice to what is stipulated elsewhere in this privacy policy, under no circumstances the Data Controller will make the personal data accessible to other Users and/or third parties.
2. accounting-administrative purposes, or in order to carry out organisational, administrative, financial and accounting activities, as internal organisational activities and activities aimed at fulfilling contractual and precontractual obligations;
3. legal obligations, or in order to fulfil obligations provided by the law or the European laws and regulations.

Providing the personal data for the processing purposes specified above is optional but necessary, since failing to provide the same imply the impossibility for the User to make a request to the Data Controller.

2. Processing methods and data retention

The Data Controller will carry out the processing of Users’ personal data by manual and IT instruments, applying logics strictly connected to the purposes and, in any case, so that the safety and confidentiality of the relevant data is guaranteed.

Users’ personal data will be retained for the time strictly necessary to carry out the relevant purposes described in the previous paragraph 1, and in any case for the time necessary for the protection of the civil interests of the Users and of the Data Controller.

3. Data disclosure and dissemination

Data Controller’s employees and/or workers appointed to manage the Website and/or the Users’ requests may become aware of any Users’ personal data. Such subjects, who are formally appointed by the Data Controller as “persons in charge for the processing“, will process the relevant User’s data exclusively for the purposes specified under this privacy policy and in compliance with the provisions of the Applicable Regulation.

Furthermore, third parties which may process personal data for the account of the Data Controller may become aware of any Users’ personal data in their capacity as “external data processor“, such as, including, but not limited to, providers of logistics and IT services functional for the Website operational, outsourcing or cloud computing services providers, professionals and advisors.

Users have the right to obtain a list of the external data processors (if any) appointed by the -Data Controller upon a specific request to be made to the Data Controller following the modalities specified under the following paragraph 4.

4. Data subjects’ rights

Users may exercise their rights granted by the Applicable Regulation by contacting the Data Controller as follows:

• Sending a registered letter to the registered office of the Data Controller: Via Dogana no. 3 – 20123 Milan (Italy);
• Sending an e-mail to: mamma2.0srl@legalmail.it

Pursuant to the Applicable Regulation, the Data Controller hereby informs that any Users has the right to obtain the indication of:

1. the source of the personal data;
2. the purposes and methods of the processing;
3. the logic applied to the processing, if the latter is carried out with the help of electronic means;
4. the identification data concerning Data controller and data processors;
5. the entities or categories of entity to whom or which the personal data may be communicated and who or which may get to know said data in their capacity as designated data processor(s) or person(s) in charge of the processing.

Furthermore, data subjects have the right to obtain:

1. access, updating, rectification or, where interested therein, integration of the data;
2. erasure, anonymization or blocking of data that have been processed unlawfully, including data whose retention is unnecessary for the purposes for which they have been collected or subsequently processed;
3. certification to the effect that the operations as per letters a) and b) have been notified, as also related to their contents, to the entities to whom or which the data were communicated or disseminated, unless this requirement proves impossible or involves a manifestly disproportionate effort compared with the right that is to be protected.

Furthermore, Users have:

1. the right to withdraw the consent at any time, when the processing is based on consent;
2. the right to data portability (if applicable), that is the right to receive all the personal data concerning the User, in a structured, commonly used and machine-readable format; the right to restriction of processing of the personal data; the right to erasure (right to be forgotten).
3. the right to object:
   1. in whole or in part, on legitimate grounds, to the processing of personal data concerning him/her, even though they are relevant to the purpose of the collection;
   2. In whole or part, the handling of personal data for the purpose of sending advertising or sales materials or for the carrying out of market research or for commercial communication purposes;
   3. If personal data is processed for direct marketing purposes, at any time, to the processing of data for this purpose, including profiling in so far as it is related to such direct marketing.
4. the right to lodge a complaint with a supervisory authority (in the Member State of his or her habitual residence, place of work or place of the alleged infringement) if the User considers that the processing of personal data relating to him/her infringes the Regulation. The Italian Data Protection Authority is the Garante per la protezione dei dati personali, with registered office in Piazza di Monte Citorio, n. 121, 00186 – Rome (Italy) (http://www.garanteprivacy.it).

The Data Controller is not responsible for updating all links that can be viewed in this privacy policy, therefore whenever a link is not functional and/or updated, Users acknowledge and accept that they must always refer to the document and/or section of the websites referred to such link.