PRIVACY POLICY
This Privacy Policy provides users of this Site (the “Site”) with the most complete and clear information on the processing of their personal data through the Site pursuant to the General Data Protection Regulation (GDPR) and the Italian Personal Data Protection Code.
In accordance with legal requirements, this Privacy Policy also indicates:
the nature of the personal information processed;
the purposes and means of processing personal information;
the identity and contact details of the data controllers;
the contact details of the Data Protection Officer (DPO);
any third parties involved in the processing activities;
the retention period of personal information;
the security measures adopted to protect personal information;
users’ privacy rights;
This Privacy Policy applies exclusively to the Site and does not cover any website or platform to which the Site may link.
Users under the age of 16 (sixteen) may not give consent to the processing of personal data without parental authorisation.
1. Data Controller
Under the GDPR, the data controller is the entity which, alone or jointly with others, determines the purposes and means of the processing of personal information.
The joint controllers for the processing of data relating to the activities of the Site are:
Kora S.r.l., Via Leonino da Zara 29, 35020 Albignasego (PD), Italy
The Level S.r.l., Piazza Arcole 4, 20143 Milan (MI), Italy
(the “Joint Data Controllers”).
The data controller is:
The Level S.r.l. ("the Vendor"), Piazza Arcole 4, 20143 Milan (MI), Italy; contact: privacy@thelevelgroup.com
A Data Protection Officer has been appointed by The Level S.r.l. to ensure that the Site processes personal information in compliance with the GDPR. The Data Protection Officer can be contacted for any request at the following e-mail addresses: privacy@thelevelgroup.com and dpo@thelevelgroup.com.
With regard to the personal information of unregistered users who have chosen to receive newsletters and marketing communications, The Level S.r.l. and Kora S.r.l. act as Joint Data Controllers.
2. Personal information. Purposes of processing.
The expression “Personal information” means any information relating to users that identifies them personally, alone or in combination with other information.
Personal information is collected automatically by the Site or received through multiple sources: forms, chat, e-mail, apps, devices, social media and other means.
The Site processes personal information in various forms for the following purposes:
3. Browsing data
The Site collects non-sensitive browsing data by automated means in order to enable and improve the user’s browsing (for example IP address, date/time of the visit and its duration, any referring URLs, pages visited on the Site, device used and other information).
The processing of this information allows users to access the Site and take full advantage of its features and services. In addition, browsing data may be used to verify that the Site is working properly.
From time to time, browsing data is processed anonymously for statistical purposes.
Browsing data is unlikely to allow the identification of the data subject. However, by its very nature, browsing data may allow users to be identified if associated with other information.
The browsing data described above is stored only temporarily in accordance with applicable law.
4. Orders
At checkout, the Site asks users to provide personal information for the essential purpose of fulfilling their purchase orders and complying with contractual obligations (for example first and last name, e-mail address, delivery address, etc.).
This personal information is also essential to enable Customer Service to assist customers with their requests and any related needs, before or after the sale (for example, regarding the delivery status of the order or product returns).
Personal information relating to orders will be retained for as long as necessary to fulfil contractual obligations and applicable tax and financial reporting obligations.
The Site may also verify the payment instruments used by customers for purchases on the Site (for example credit or debit card, etc.), mainly to prevent fraudulent activities or pursuant to applicable anti-money laundering laws. Since full reliance is placed on third-party payment processors for payment verification, the Data Controllers do not process or store financial information belonging to customers.
Failure to provide the personal information requested at checkout will prevent users from completing an order on the Site.
On the basis of its legitimate interest in improving the relationship with customers, the Site will send customers e-mail communications with product suggestions, discounts, feedback requests or other updates. Customers are always free to unsubscribe from such e-mail communications (for example, by clicking on the “unsubscribe” link at the bottom of each e-mail).
5. Registration on the Site
When users choose to register a personal Site account, they are asked to submit personal information (for example date of birth, gender, etc.). The Site clearly indicates which personal information is mandatory (or not) to set up a Site account.
Users must provide true and accurate personal information at registration and are invited to keep their personal information up to date (if any changes occur) by accessing their personal account to make all appropriate changes.
Users who choose to activate or access their Site account through a social media account should be aware that, when they link their Site account to a social media account, the Site collects certain personal information that the user has already provided to that social media (for example, the e-mail address and public profile on Facebook).
The Data Controllers do not supervise or control such social media services or users’ profiles on these services and do not set the privacy settings or the rules regarding how personal information is used on such services. Users are strongly encouraged to read all applicable social media policies and information to learn more about how personal information is processed.
6. Newsletters and marketing communications
On the Site, users can choose to receive newsletters and commercial communications.
The Site always collects users’ explicit, free and unambiguous consent before sending newsletters and marketing communications to such users or, more generally, before undertaking any electronic marketing initiatives dedicated to them.
In such cases, users may be asked to provide personal information in addition to their e-mail address (e.g. gender, country of residence, etc.) in order to receive marketing communications and newsletters tailored to their user profile.
Users can always easily withdraw their consent to receive newsletters and commercial communications in the following ways:
through their account settings;
by clicking on the ‘unsubscribe’ link in any such e-mail;
by contacting our Customer Service.
With regard to the personal information of unregistered users who have chosen to receive newsletters and marketing communications, The Level S.r.l. acts as sole data controller.
Please note that, in the context of communications sent by e-mail (newsletters), Malìparmi may use tracking pixels, i.e. small, invisible graphic elements embedded in messages that can detect the opening of the communication and certain technical information relating to the recipient’s interaction, such as date and time of opening, IP address, device type, operating system, e-mail client and other similar technical information, to the extent necessary to evaluate the outcome of marketing campaigns and for remarketing activities.
7. Profiling
Based on the user’s explicit consent, newsletters and marketing communications may be tailored to the user’s “profile”, based on the personal information that the Site collects or receives about the user concerned.
With regard to the Site’s customers, it is in the Site’s legitimate interest to process personal information in order to offer more interesting products, improve the Site and personalise the products offered on the Site.
The main purpose of profiling is to offer products, services and initiatives that better match the tastes, purchasing habits and interests of users and customers.
Personal information may also be used for remarketing, retargeting or profiling purposes, including through third parties (e.g. social networks, etc.).
Neither the Site nor the Data Controllers will ever carry out profiling activities relating to children.
8. Cookies
Information on the cookies used on the Site is available at the following link: Cookie Policy.
9. Sharing and transfer of personal information
The Data Controllers may transfer customers’ personal information to primary third-party suppliers, acting as “data processors” (the “Processors”), so that they can carry out the business operations necessary to fulfil their contractual obligations.
The Data Controllers will do their best to ensure that all Processors apply industry best practices to protect personal information and do not use personal information for purposes other than those agreed with the Data Controllers.
For example, the Data Controllers may share personal information with the following categories of Processors:
Couriers and postal operators;
Order fulfilment centres and warehouses;
Advertising, digital, marketing and social media agencies;
IT service providers;
Customer service providers;
Payment service providers;
In such cases, sharing personal information with the Processors is necessary to enable the Data Controllers to fulfil their contractual obligations and, in addition, to improve the Site’s products and services.
Users may request an updated list of the Processors involved in the processing of personal information relevant to the Site’s activities by sending an e-mail to: privacy@thelevelgroup.com.
The Data Controllers shall always reserve the right to disclose personal information about users as required by law (for example, in response to law enforcement requests) and where necessary to protect the rights of the Data Controllers or their affiliates or of third parties.
In addition, personal information may be disclosed to other companies within the same corporate group as each of the Data Controllers or to third parties in the event of a corporate restructuring process, in full compliance with applicable law.
In all other cases, the sharing of personal information will be subject to the user’s prior and explicit consent, unless the processing is permitted under an alternative legal basis.
The Data Controllers will not transfer any personal information outside the European Economic Area (EEA), unless the user has explicitly authorised such transfer or the transfer of personal information outside the EEA is permitted by the GDPR on another legal basis.
10. Processing methods and security measures
Users’ personal information is processed by the Data Controllers using IT, automated and electronic tools and, in limited cases, using paper-based means. In accordance with the GDPR, specific security measures have been implemented to prevent data loss, unlawful or incorrect use and unauthorised access.
Only authorised employees of the Data Controllers and authorised employees of third-party suppliers, acting as Processors on behalf of the Data Controllers, have access to personal information relating to the Site’s activities. Data processing agreements are in place with the Processors to ensure that they always meet the level of security required by the GDPR when processing personal information relating to the Site’s activities.
Although the Site adopts primary security measures to prevent the loss, destruction or disclosure of personal information, it cannot exclude the security risks that are naturally linked to the online transmission of data. The user accepts the risks inherent in providing personal information on the Internet and will not hold the Site liable for any security breach, unless such breach is due to negligence or wilful misconduct of the Site.
With specific reference to any tracking pixels used in marketing e-mails, Malìparmi adopts technical and organisational measures consistent with the principles of privacy by design and privacy by default, limiting the data collected to what is necessary, avoiding, where possible, the use of directly intelligible identifiers and keeping tracking data separate from other customer information.
11. Retention of personal information
The Data Controllers will retain personal information for as long as necessary to provide users and customers with the requested services, to comply with legal or tax obligations, or for the minimum period prescribed by law.
In order to determine the appropriate retention period for personal information stored by the Site with the user’s consent, the Data Controllers will take into account multiple factors to ensure that personal information is not retained for longer than necessary or appropriate. These criteria will also include:
The purpose for which the Site holds personal information;
Legal, tax and regulatory obligations related to such personal information;
The type of ongoing relationship with the user or customer concerned (how often the user accesses their Site account, whether users continue to receive marketing communications, how regularly they browse or purchase on the Site, etc.);
Any specific request from the user relating to the deletion of personal information;
Legitimate business interests.
The Site will promptly delete or anonymise personal information that is no longer necessary or required to be retained by law.
In particular: data processed for purposes related to sales is retained for the period necessary to perform the contract and the related services, as well as for the subsequent period required by civil and tax law; where the user has given consent, data collected for the purpose of analysing and studying consumption habits and choices is retained for a maximum of 10 years from the user’s last interaction.
12. Links to third-party websites or platforms
The Site may contain banners, advertisements and other links to third-party websites or platforms. The Data Controllers cannot control or be held responsible for the conduct of such third-party websites or platforms in relation to privacy law. Users are invited to read their privacy policies to check how they collect and process personal information.
13. Users’ rights
Users have the right to obtain confirmation as to whether or not the Data Controllers hold personal information about them.
In such case, under the GDPR, users also have the right to:
be informed about the collection and use of their personal information;
access their personal information free of charge;
obtain the rectification or completion of inaccurate or incomplete personal information;
obtain the erasure of personal information (“the right to be forgotten”);
under specific conditions, obtain the restriction or suppression of their personal information;
obtain and reuse their personal information for their own purposes across different services when the processing is based on a contract or on consent and is carried out by automated means (“the right to data portability”);
under specific conditions, object to the processing of their personal information;
object at any time to the use of personal information for “profiling” or “automated decision-making” purposes;
lodge complaints concerning the collection and processing of personal information with the competent supervisory authority;
withdraw consent to the processing of personal data at any time.
Please also note that data subjects may withdraw their consent to tracking via the pixels contained in newsletters at any time by contacting Customer Service.
Users may contact the Site for any request and to exercise their privacy rights at the following e-mail address: privacy@thelevelgroup.com.
14. Changes to this Privacy Policy
Any future changes to this Privacy Policy will be published on the Site and, where appropriate, notified to users by e-mail. Users are invited to read this Privacy Policy regularly to check for any updates or changes.
Last updated: March 2025