Privacy Policy

Lybre Srl, with its registered office at VIALE ABRUZZI 30, 20131, Milan, CAP, 20131 (hereinafter referred to as the “Controller”), owner of this website (hereinafter, the “Website”), as the data controller of the personal data of users browsing the Website and participating in the prize contest accessible from the Website (hereinafter, the “Users”), provides the following privacy notice in accordance with Article 13 of EU Regulation 2016/679 of April 27, 2016 (hereinafter, the “Regulation” or “Applicable Law”).

This Website and the prize contest accessible from the Website are reserved for individuals who are at least 18 years old. The Controller does not collect personal data from individuals under 18. Upon request from Users, the Controller will promptly delete any personal data unintentionally collected from individuals under 18.

The Controller highly values the right to privacy and personal data protection of its Users. For any information regarding this privacy notice, Users may contact the Controller at any time through the following means:

• By sending a registered letter with return receipt to the Controller’s registered office: VIALE ABRUZZI 30, 20131, Milan, CAP, 20131
• By contacting the Data Protection Officer (DPO) at [email protected]

1. Purpose of Data Processing

Users’ personal data will be lawfully processed by the Controller under Article 6 of the Regulation for the following purposes:

• Contractual obligations:
  
  • To enforce the rules of the prize contest, which the User accepts upon registration.
  • To fulfill specific User requests.
  • The personal data collected for participation include: gender, first name, last name, date of birth, postal address, email address, and phone number, as well as any other personal information voluntarily provided by the User.
  • Unless the User explicitly provides consent for marketing purposes (see Section 2) or data sharing with third parties (see Section 3), the above data will be used solely to verify the User’s identity (including email validation), prevent fraud or abuse, and contact the User for service-related reasons only (e.g., managing participation in the prize contest, notifying about winnings, handling the prize awarding and delivery process).
  • The Controller may also contact the User to request additional data and information (such as a copy of an identity document) as required by a notary or an official responsible for monitoring prize contests to verify the User’s identity and prevent fraud or abuse.
  • Urgent communications may be made by phone during the prize collection and redemption process.
• Ensuring proper Website navigation:
  
  • The Controller collects personal data implicitly transmitted when using internet communication protocols.
  • These data include IP addresses, domain names of computers used by Users, URI (Uniform Resource Identifier) addresses of requested resources, request timestamps, request submission methods, server response file sizes, numerical codes indicating server response status (success, error, etc.), and other technical parameters related to the User’s operating system and computing environment.
  • These data are used only for anonymous statistical analysis of Website usage and to ensure proper functionality.
  • Except as provided in this privacy policy, under no circumstances will the Controller make Users’ personal data accessible to other Users and/or third parties.
• Administrative and accounting purposes:
  
  • This includes performing organizational, administrative, financial, and accounting activities, such as internal organization tasks and activities necessary to fulfill contractual and pre-contractual obligations.
• Legal obligations:
  
  • The Controller processes data to comply with legal, regulatory, or European legislation requirements (e.g., tax law, regulations on prize contests – D.P.R. 430/2001).

Providing personal data for the above processing purposes is optional but necessary, as failure to provide data will make it impossible for the User to access the services offered by the Controller on the Website and participate in the prize contest.

2. Additional Processing Purposes: Marketing (Sending Advertising Material, Direct Sales, and Commercial Communication)

With the free and optional consent of the User, certain personal data (such as gender, first name, last name, date of birth, postal address, email address, and phone number) may also be processed by the Controller for marketing purposes (sending advertising material, direct sales, and commercial communication). This means that the Controller may contact the User via mail, email, phone (landline and/or mobile, using automated calling or communication systems with or without an operator), SMS, and/or (with the User’s free and optional consent requested through their browser) push notifications and/or social marketing campaigns (e.g., Facebook) to propose the purchase of products and/or services offered by the Controller and/or third-party companies, as well as to present offers, promotions, and commercial opportunities.

If consent is not given, the User’s ability to participate in the contest will not be affected in any way.

If consent is given, the User may revoke it at any time by making a request to the Controller using the methods indicated in Section 6 below.

The User may also easily object to further promotional communications via email by clicking the unsubscribe link included in each promotional email. Once consent is revoked, the Controller will send the User an email confirming the revocation. If the User wishes to revoke consent for promotional communications via phone but continue receiving them via email, or vice versa, they should send a request to the Controller using the methods outlined in Section 6.

Specifically, the User may revoke consent for push notifications through their browser settings related to notifications.

The Controller informs the User that, after exercising their right to object to promotional emails, it is possible that, for technical and operational reasons (e.g., contact lists being finalized shortly before receiving the objection request), the User may still receive some promotional messages. If the User continues to receive promotional messages beyond 24 hours after exercising the right to object, they should report the issue to the Controller using the contact details provided in Section 6.

3. Additional Processing Purposes: Data Sharing with the Controller’s Partners

With the free and optional consent of the User, their personal data (including gender, first name, last name, postal address, email address, and phone number) may be shared by the Controller with the following categories of third-party companies:

• Telecommunications and mobile/landline phone companies (including Vodafone Italia Spa)
• Companies in the publishing industry (printed media, new media, and television, including pay-TV)
• Companies operating in e-commerce (products and services)
• Companies in the utilities sector (gas, electricity, water, photovoltaics, and water purification)
• Tourism and leisure companies (tour operators, travel agencies, and transportation companies)
• Companies providing professional and/or academic training
• Advertising and marketing agencies, media centers, market research firms, and contact centers
• Companies involved in the production and/or trade of consumer goods (food and beverages, non-food grocery items, cosmetics and healthcare, clothing, semi-durable goods)
• NGOs, non-profit organizations, and foundations
• Companies operating in the betting and lottery sector (with an AAMS license)
• Companies in the automotive sector
• Companies in the financial, banking, and insurance sectors
• Sports organizations
• Employment agencies and recruitment firms

(Collectively referred to as the “Controller’s Partners”).

The Controller’s Partners as Independent Data Controllers

The Controller’s Partners, acting as independent data controllers, will process the User’s personal data for their own marketing purposes (direct sales, sending advertising material, and commercial communication). They may contact the User via mail, email, telephone (landline and/or mobile, with automated calling or communication systems, with or without an operator), SMS, and/or through social marketing campaigns (such as Facebook) to promote the purchase of products and/or services offered by the same categories of third-party companies and/or other businesses, as well as to present the User with offers, promotions, and commercial opportunities.

Once the data transfer has taken place, it will be the responsibility of the Controller’s Partners to provide the User, in accordance with Article 14, paragraph 3 of the Regulation, with all the information required by Article 14 of the Regulation.

If consent is not given, the User’s ability to participate in the prize contest will not be affected.

If consent is given, the User may revoke it at any time by making a request to the Controller using the methods indicated in Section 6.

The Controller informs the User that their personal data will be processed by the Controller’s Partners as independent data controllers, based on the specific privacy notice that will be provided by the Partners in accordance with Article 14, paragraph 3 of the Regulation. Any requests to stop receiving further commercial communications from the Controller’s Partners—after the data has already been transferred—must be addressed directly to those Partners.

4. Methods of Processing and Data Retention Period

The Controller will process Users’ personal data using both manual and electronic tools, with methods strictly related to the intended purposes, ensuring the security and confidentiality of the data.

• For the purposes stated in Section 1, Users’ personal data will be stored only for the time strictly necessary to fulfill the primary purposes related to their participation in the contest or, in any case, for the time necessary to protect the interests of both the Users and the Controller in civil proceedings. This period ranges between 5 years and, in the event of litigation, up to 10 years.
• For the purposes stated in Sections 2 and 3, Users’ personal data will be retained only for the time necessary to fulfill the purposes described, and in any case no longer than twenty-four (24) months from the time the data was collected and/or received.
• Exceptionally, personal data intended for the Controller’s Partners belonging to the following categories:
  i) Telecommunications and mobile/landline phone companies
  ii) Companies in the publishing industry (printed media, new media, and television, including pay-TV)
  iii) Companies in the utilities sector (gas, electricity, water, photovoltaics, and water purification)
  will be retained by the Controller for a maximum period of forty-eight (48) months, due to the specific nature of the products and services they offer and the assessments conducted regarding data retention.

The retention period for data by the Controller’s Partners can be found in the privacy notice provided by them, in accordance with Article 14 of the Regulation.

5. Data Communication and Disclosure

The Controller’s employees and/or collaborators who manage the Website may become aware of Users’ personal data. These individuals have been instructed accordingly by the Controller, in compliance with Article 29 of the Regulation, and will only process the User’s data for the purposes stated in this privacy notice, in accordance with Applicable Law.

Additionally, third-party entities may also become aware of Users’ personal data, processing them on behalf of the Controller as “External Data Processors”, including but not limited to:

• IT service providers and logistics services providers essential for Website operations
• Outsourcing service providers or cloud computing service providers
• Professionals and consultants

Users’ Rights to Obtain Information on Data Processors

Users have the right to obtain a list of any data processors appointed by the Controller by requesting it using the methods indicated in Section 6.

Additionally, Users’ personal data may be disclosed by the Controller—only as necessary to fulfill contractual obligations and/or comply with legal requirements—to independent data controllers, such as notaries and chamber officials responsible for selecting the winners of the prize contest organized on the Website, the Ministry of Economic Development, and any third parties mentioned in the contest regulations. These third parties must necessarily process the data to allow the User to claim any prizes won (e.g., travel agencies, ticketing services, hotels, etc.).

6. Users’ Rights

Users may exercise their rights under the Applicable Law by contacting the Controller through the following means:

• By sending a registered letter with return receipt to the Controller’s registered office:
  VIALE ABRUZZI 30, 20131, Milan, CAP, 20131
• By sending an email to [email protected]
• Lybre Srl, with its registered office at VIALE ABRUZZI 30, 20131, Milan, CAP, 20131

In accordance with Applicable Law, the Controller informs Users that they have the right to obtain:

1. Information regarding:
   
   • (i) The origin of personal data
   • (ii) The purposes and methods of processing
   • (iii) The logic applied when processing is carried out using electronic tools
   • (iv) The identification details of the data controller and any data processors
   • (v) The entities or categories of entities to whom the data may be disclosed or who may access the data as data controllers or processors
2. The right to request:
   
   • (a) Access, updates, corrections, or, where applicable, integration of data
   • (b) Deletion, anonymization, or blocking of data processed unlawfully, including data that does not need to be stored for the purposes for which it was collected or subsequently processed
   • (c) Confirmation that the operations described in points (a) and (b) have been communicated to those to whom the data was disclosed, except where such notification is impossible or requires disproportionate efforts
3. Additionally, Users have the right:
   
   • To withdraw their consent at any time if the processing is based on their consent (note: withdrawal does not affect the lawfulness of processing based on consent before the withdrawal)
   • To data portability (i.e., the right to receive all personal data concerning them in a structured, commonly used, and machine-readable format)
   • To restrict processing of their personal data
   • To request data deletion (“right to be forgotten”)
4. Users also have the right to object:
   
   • In whole or in part, for legitimate reasons, to the processing of their personal data, even if relevant to the purpose of collection
   • In whole or in part, to the processing of their personal data for direct marketing purposes, including automated decision-making and profiling related to such marketing
   • At any time, to the processing of their personal data for direct marketing, including profiling to the extent that it is related to such direct marketing
5. Right to file a complaint:
   
   • If Users believe their data processing violates the Regulation, they have the right to lodge a complaint with a Supervisory Authority in the Member State where they reside, work, or where the alleged violation occurred.
   • The Italian Supervisory Authority is the Garante per la Protezione dei Dati Personali, located at Piazza Venezia 11, 00187, Rome (http://www.garanteprivacy.it).

The Controller is not responsible for updating all links displayed in this Privacy Notice. Users acknowledge and accept that, if a link is non-functional or outdated, they should always refer to the official document and/or section of the websites referenced by the link.