Privacy Policy | Eathlon

PRIVACY POLICY – CONTRACTUAL NOTICE AND EXPLICIT CONSENT

(pursuant to and for the purposes of Arts. 13-14 of Regulation (EU) 2016/679 – the European Regulation on the protection of personal data – and implementing decree no. 101/2018)

This contractual notice – Privacy Policy – is displayed by clicking the relevant option on the home page of the website www.eathlon.it of CORPORE SANO S.R.L., and by clicking the link “Privacy Notice” during registration in the Eathlon app.

Pursuant to Arts. 13 and 14 of Regulation (EU) 2016/679 (in short, the GDPR) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and in compliance with Legislative Decree no. 101 of 10 August 2018 containing “Provisions for the adaptation of national legislation to the provisions of the GDPR”, CORPORE SANO S.R.L. intends to inform users who wish to register on or simply browse this website about the specific features of the services and the methods of processing of personal data. This page mainly highlights the purposes and the legitimacy of the processing of data arising from the user’s free will to become a customer or potential customer of CORPORE SANO S.R.L., by accepting the registration of their personal data in the dedicated form available in the Eathlon app, a will that expresses consent to the processing and whose final acceptance constitutes a contractual form between the parties.

Data controller

The data controller of personal data is CORPORE SANO S.R.L., in the person of its Sole Director – Dr. Ruggiero Cortellino -, as legal representative of the Company, with registered office in Piazza dei Martiri, 30 – Naples – VAT no. 09017141210 – email: info@eathlon.it .

The person delegated to process personal data is Dr. Stefania Dellatte, nutritionist and food technologist, as the qualified professional responsible for the meal plans.

Data processor

CORPORE SANO S.r.l. has appointed as data processor, under the service contract for digital processing and for the cloud-based delivery of services, the company that supplies the software and technology services, IG Solutions, with registered office at Via San Gaetano 72, 31044 Montebelluna (TV).

Purposes of data processing

The purpose of the processing of personal data is to provide specific meal plans through the digitalisation of the nutritionist’s activity, which enables the automatic generation of such plans in a personalised manner for the customer who registers in the Eathlon app. For this purpose, an appropriate scientific methodology based on the Mediterranean Diet and Functional Nutrition is used, making the EATHLON service a tool capable of helping the registered customer achieve their psychophysical well-being by generating a complete personalised meal plan, tailored to the needs and characteristics of each individual person.

Lawfulness and legal basis of processing

Pursuant to Art. 6 of Regulation (EU) no. 2016/679, the processing of personal data is carried out following the consent to data processing that users freely and knowingly give through the form provided in the dedicated section of the Eathlon app. The entry of such data by the user therefore constitutes explicit acceptance of the processing of their personal data, from collection through to storage in digital format. This method of accepting the services provided represents the contractual form by which:

The CUSTOMER subscribes to a periodic subscription of their choice from among those available, within which to receive the meal plans based on the data submitted, after having made the relevant payment in the manner described.
In addition, the user warrants the truthfulness of the data submitted to CORPORE SANO S.R.L., including its accuracy and being up to date.
CORPORE SANO S.R.L. undertakes to prepare the meal plans and, consequently, to process personal data, including profiling data, in order to:

a) Acquire, store and digitally profile personal data relating to determining personal circumstances and strictly necessary for the application of the methodology and of the tool designed for preparing the meal plans.
b) Respond to the request received and for any related subsequent communications.
c) Create a digital archive in order to inform or update the user, on an asynchronous basis, about the online services that CORPORE SANO S.r.l. will make available from time to time in the future, including opportunities, special programmes, commercial information and new online services.
d) Disclose data to identified third parties connected with CORPORE SANO S.r.l. in order to improve the range of services offered to the customer.
e) Process statistical data for business marketing purposes in order to improve the quality of the processing, including beyond the validity period of the subscription taken out.
f) Continue to provide the online services free of charge for up to 60 days after expiry of the subscription taken out with consent to the processing of personal data; beyond this period, in order to continue to use them, the customer will have to register again and give explicit consent.
g) Prepare the meal plans and related online services also for minors under 16 years of age. In this case, legitimacy is obtained through the explicit consent of a parent or of the person exercising parental authority or parental responsibility, using the dedicated online consent form, available in the same personal data protection section of this website, after this notice.

The storage methods are described in the following section of this notice.

Categories of data processed, categories of data subjects and retention period

Personal data or data attributable to natural persons

The data collected in order to prepare the meal plans and related online services refers to all users who explicitly intend to become customers of CORPORE SANO S.R.L. Therefore, the personal data may refer to anyone who uses the form for registration and for taking out a subscription, without distinction of gender or other personal qualifications, with the exception of age. Indeed, it is established that for persons under 16 years of age, pursuant to Art. 8 of the GDPR, the explicit consent of a parent or of the holder of parental responsibility is required in order to use the online services, without prejudice in all cases (paragraph 3 of Art. 8) to national provisions on contract law (such as the rules on the validity, formation or effect of a contract in relation to a minor). For this latter purpose, which requires full legal capacity attainable upon reaching the age of majority, the authorisation of a parent or of the holder of parental responsibility is necessary for the processing of minors’ data, as contractual effect must be given to this notice and to the resulting consent. CORPORE SANO S.R.L., in compliance with European legislation, intends to raise the minimum age for the autonomous exercise of consent to 18 years, by reason of the particular nature of the data processed and of the services that can be received.

The Customer, therefore, having read this notice, assures that the data they provide to CORPORE SANO S.R.L. is truthful, correct and up to date and assumes personal responsibility should they give consent on behalf of minors under 18 years of age, holding CORPORE SANO S.R.L. harmless from any liability, being aware of the contractual effect of explicit consent.

Personal data is of two types:

a) Common personal data: first name, last name, address and other email and telephone contact details, age.
b) Special categories of data: food preferences, food intolerances or allergies, sports practised, biological data, physical data (weight, height, body fat percentage), health data, meal plan.

All categories of data are processed with respect for their integrity and confidentiality, and are processed with algorithms suitable for describing the meal plans, in compliance with the established scientific methodology and under the supervision of the delegated nutritionist and food technologist of CORPORE SANO S.R.L.

The meal plan is available within the Eathlon app and its storage is the responsibility of the Customer.

The digital formats of personal data, including the meal plans originally prepared and updated, are stored by CORPORE SANO S.R.L. using technological tools and technical and organisational methods that ensure compliance with confidentiality and protection measures, also with the support of the Data Processor, which provides, among other things, the cloud and storage service.

The retention period depends on the type of data and on the subscription period, as chosen by the Customer. On this basis, the digital retention period for special categories of data is normally up to 60 days following expiry of the subscription, in order to continue to provide the online digital meal plan service free of charge. After this period, the special categories of data are separated from the common data through the process of pseudonymisation, as provided for by the GDPR. In this case, the digital meal plan service ends and the Customer will have to register again if they wish to use it further.

Common personal data is stored on an ongoing basis in order to provide information and update services, excluding the meal plans.

In all cases, the Customer may request the deletion of their personal data or exercise the other rights provided for by the GDPR and by the national implementing legislation, as summarised below. Providing the common and special categories of personal data requested is necessary for the online services.

Finally, personal data may be used for statistical purposes and for research in order to improve the offer and the quality of the digital processing.

Rights of data subjects

Customers to whom the personal data relates have the right, at any time, to obtain confirmation of whether or not such data exists and to know its content and origin, to verify its accuracy or to request its supplementation, updating or rectification. In particular, where applicable, the data subject may exercise the rights set out in Arts. 15 to 21 of the GDPR, which are merely summarised here by way of example and not exhaustively, and for further details of which reference is made to a reading of those articles:

rectification of data, that is, its updating or modification;
erasure of data;
restriction of processing;
data portability;
access to personal data
to request confirmation of the existence of personal data concerning them and to receive communication of it;
to obtain information about: the origin of the personal data, the purposes and methods of processing; the logic applied to processing carried out with the aid of electronic means; the identification details of the controller, the processors and the designated representative, the parties or categories of parties to whom the personal data may be disclosed or who may become aware of it as designated representative in the territory of the State, as processors or persons in charge of processing;
to request its updating, rectification or supplementation;
to request the erasure, anonymisation or blocking of data processed in breach of the law;
to object, in whole or in part, to the processing of personal data concerning them, even where relevant to the purpose of collection;
to object, in whole or in part, to the processing of personal data concerning them for the purpose of sending informational material or carrying out market research;
to obtain confirmation of whether or not such data exists and to know its content and origin, also in order to verify its accuracy or to request its supplementation, updating or rectification.

Under the GDPR, users also have the right to request the erasure, anonymisation or blocking of data processed in breach of the law, as well as to object in any case, on legitimate grounds, to its processing. The data subject has the right to lodge a complaint with the Italian Data Protection Authority (Autorità Garante per la protezione dei dati personali) in relation to the processing covered by this Notice. These rights can be exercised directly by sending a communication to the following email addresses: info@eathlon.it, or alternatively by sending a registered letter with return receipt to the address of CORPORE SANO S.r.l., as indicated above.

CONSENT GIVEN TO CORPORE SANO S.R.L. FOR THE PROCESSING OF PERSONAL DATA

In order to use the services of CORPORE SANO S.R.L., I am aware that I must give my consent to the processing of personal data through at least one of the following methods, digitally recorded for evidentiary and legal purposes:

1) Click the flag “I consent to the processing of personal data” on the registration page of the Eathlon app and prior to it. This option allows personal data to be entered for registration for the service offered, expressing the will to become a Customer of CORPORE SANO S.R.L.

ADDITIONAL AND SPECIFIC NOTICE ON THE WEB PROCESSING OF PERSONAL DATA, INTEGRATED WITH THE PRIVACY POLICY

In application of the Italian Data Protection Authority’s Provision no. 229/214 on “Simplified arrangements for providing information and obtaining consent for the use of cookies – 8 May 2014”, without prejudice to what has already been declared and stated in the Privacy Policy – Contractual Notice, drawn up in compliance with Regulation (EU) no. 679/2016 and with the national implementing legislative decree, no. 101/2018, it is specified, with regard to the processing of personal data through this website, that:

This notice is provided only for the website of CORPORE SANO S.R.L. and for the Eathlon app starting from the home page address www.eathlon.it and not also for other websites that may be consulted by the user via links available on the same web page.

Types of data processed through the website

It is specified that, in addition to the common and special categories of personal data that are directly and voluntarily entered by the user in the course of browsing and, where applicable, of registration for taking out the subscription for the preparation of the digital meal plan, the web processing carried out through this site may concern the following further types:

a) Browsing data.

During browsing on the website of CORPORE SANO S.R.L. www.eathlon.it the IT systems and software procedures that run the site collect some personal data whose transmission is implicit in the use of Internet communication protocols.

Examples of this type of data are the IP addresses or domain names of the computers used by users who connect to the site, the URI (Uniform Resource Identifier) addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other information relating to the user’s operating system and IT environment.

The above data, although not by itself attributable to identified users, could make it possible to identify the users to whom it refers through processing with data held by third parties. For this reason, data in these categories is protected with IT security systems and technical and organisational measures suitable for maintaining its integrity, confidentiality and availability over time

However, it may be used by CORPORE SANO S.r.l. solely for the purpose of producing anonymous statistics on use of the site and of checking that it is functioning correctly.

Such data could also be used by the Police and Judicial Authorities for ascertaining liability in the event of hypothetical computer crimes against the site. Apart from this eventuality, as a rule it is retained for no more than thirty days beyond the validity period of the subscription contracted through the data subject’s consent.

b) Data voluntarily provided by the user via the web.

The user may consult the Privacy Policy and this notice at any time while browsing and may use the interaction methods provided and described to give their consent to the contractual arrangement and to the processing of their personal data. Likewise, they may delete their digital position on this website.

The collection of users’ personal data takes place voluntarily, by completing the form specifically available for submitting requests for detailed information on the services or by sending email to the addresses shown on the site.

The submission of completed forms and/or email entails the collection, by CORPORE SANO S.r.l., of identification data, data relating to food and sports choices and preferences, including the information that constitutes the content of the request, as well as the sender’s email address necessary to reply to the request by the same means, together with any other personal data contained in the communication. The purposes of the collection are set out in the Privacy Policy – sections Purposes of data processing and Lawfulness and legal basis of processing.

In using certain services of this website, personal data of third parties sent by the user to CORPORE SANO S.R.L. may be processed. In such cases, the user acts as an independent data controller, assuming all legal obligations and responsibilities. In this regard, the user grants the broadest indemnity against any claim, demand or request for compensation for damage caused by processing, etc. that may be made to CORPORE SANO S.R.L. by third parties whose Personal Data has been processed through use of the site’s functions in breach of the applicable personal data protection rules. In any event, should the user provide or otherwise process personal data of third parties in using the site, they hereby warrant – assuming all related responsibility – that this particular processing is based on a suitable legal basis pursuant to Art. 6 of the Regulation that legitimises the processing of the information in question.

c) Cookies.

Cookies are small text files that the sites visited by the user send to and store on their computer or mobile device, to be then retransmitted to the same sites on the next visit. Thanks to cookies, a site remembers the user’s actions and preferences (such as, for example, login data, the chosen language, font size, other display settings, etc.) so that they do not have to be specified again when the user returns to visit that site or navigates from one page to another. Cookies are therefore used for computer authentication, session monitoring and storing information about the activities of users who access a site, and may also contain a unique identification code that makes it possible to track the user’s browsing within the site itself for statistical or advertising purposes. While browsing a site, the user may also receive on their computer cookies from sites or web servers other than the one they are visiting (so-called “third-party” cookies). Some operations could not be carried out without the use of cookies, which in certain cases are therefore technically necessary for the very functioning of the site.

There are various types of cookies, depending on their characteristics and functions, and these may remain on the user’s computer for different periods of time: so-called session cookies, which are automatically deleted when the browser is closed; so-called persistent cookies, which remain on the user’s device until a predetermined expiry date.

Under the legislation in force in Italy, an express consent of the user is not always required for the use of cookies. In particular, such consent is not required for “technical cookies”, that is, those used for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or to the extent strictly necessary to provide a service explicitly requested by the user. In other words, these are cookies that are indispensable for the functioning of the site or necessary to carry out activities requested by the user.

Among the technical cookies, which do not require express consent for their use, the Italian Data Protection Authority (cf. Provision Simplified arrangements for providing information and obtaining consent for the use of cookies of 8 May 2014 and subsequent clarifications, hereinafter only the “Provision”) also includes:

“analytics cookies” where used directly by the site operator to collect information, in aggregate form, on the number of users and on how they visit the site itself,
browsing or session cookies (for authentication),
functionality cookies, which allow the user to browse according to a series of selected criteria (for example, the language, the products selected for purchase) in order to improve the service provided to them.

For “profiling cookies”, on the other hand, that is, those aimed at creating profiles relating to the user and used to send advertising messages in line with the preferences shown by the user while browsing the web, the user’s prior consent is required.

The site www.eathlon.it does not use cookies for the transmission of information of a personal nature, nor so-called persistent cookies of any kind, that is, user tracking systems.

The Site uses the following cookies, which can be deselected, except for third-party cookies, for which you must refer directly to the respective selection and deselection procedures for those cookies, indicated by means of links:

Technical browsing or session cookies, strictly necessary for the functioning of the site or to enable you to make use of the content and services requested.
Functionality cookies, that is, used to activate specific features of the site and a series of selected criteria (for example, the language) in order to improve the service provided.

WARNING: by disabling technical and/or functionality cookies, the site may become impossible to consult, or some services or certain functions of the site may be unavailable or not work correctly, and the user may be forced to modify or manually enter certain information or preferences every time they visit the site.

Optional nature of providing data

Apart from what is specified for browsing data, the user is free to provide the personal data shown in the request forms. Failure to provide it may make it impossible to obtain what was requested, with particular reference to the meal plan.

Categories and methods of processing

The processing relating to the categories of data and connected to the web services of this site takes place on cloud systems managed in housing by the company IG Solutions srls, as better identified above, and is carried out only by technical personnel authorised to process the data. IG Solutions Srls adopts physical, logical and organisational measures compliant with the principles of the GDPR to guarantee the confidentiality of personal data processed digitally and electronically through the software and the cloud made available to CORPORE SANO S.r.l..

No data deriving from the web service is disseminated without authorisation. The personal data provided by users who submit requests for information and suggestions is used solely for the purpose of carrying out the service or performance requested and is disclosed to other authorised public or private parties only where this is necessary to provide the information requested by the user or if requested by the Police and Judicial Authorities. Personal data is processed with automated tools for the time strictly necessary to achieve the purposes for which it was collected.

Specific physical, logical and organisational security measures are observed to prevent data loss, unlawful or improper use and unauthorised access, such as, by way of example and not limitation, as they are constantly evolving and being updated:

Identification of the personnel authorised to process personal data;
Controlled access to the processing premises;
Use of personal credentials by persons authorised to process data and to access logs;
Adoption of central and peripheral logical security systems, such as firewalls and proxy servers;
Adoption of backup systems with centralised management and secure archiving

p3p

This privacy notice can be consulted automatically by the most recent browsers that implement the P3P standard (Platform for Privacy Preferences Project) proposed by the World Wide Web Consortium (www.w3c.org).

This notice may be subject to amendments and updates, which will be communicated to users by issuing a new document.

Naples, updated on 10/01/2024