Privacy Notice

ol.priparen { list-style: none; padding-left: 1.5em; }
ol.priparen > li::marker { content: counter(list-item, lower-alpha) “) “; }

PRIVACY NOTICE

Pursuant to Article 13 of the Regulation (EU) 2016/679 containing provisions for the protection of natural persons with regard to the processing of personal data and for the free movement of such data (hereinafter the “
GDPR”), we hereby provide you with information regarding the processing of your personal data provided by you and/or collected via the websites
www.mbe.it and www.mbe-franchising.it (together the “
Websites”).

1. Data controller

Personal Data collected via the Websites will be processed by Sistema Italia 93 S.r.l., with registered office in Milan, Viale Lunigiana 35-37, 20125, exclusive licensee for Italy of the brand “Mail Boxes Etc”, in its quality of data controller (hereinafter the “
Controller” or “MBE”).

2. Categories of Personal Data processed

The following Personal Data provided by you (hereinafter the “Personal
Data”) may be processed via the Websites:

• the IP address;
• navigation data on the Websites;
• information on the browser and on the device;
• information collected through cookies, pixel tags, provided by you and without disclosing your specific
  identity;
• demographic information and other information provided by you and without disclosing your specific identity;
• information that has been aggregated in such a way as to no longer reveal your specific identity.

Moreover, the following Personal Data provided by you may be processed if you decide to interact with the Websites:

3. Purposes of processing Personal Data

The Controller will process your Personal Data for the following purposes:

1. to allow you to benefit from the features offered by the Websites, and more in detail:

2. to provide you with the services you request, and more in detail:

3. to send you, by any means of communication (fax, e-mail, text message, multimedia messaging service,
   paper-based mail, operator-assisted phone calls), advertising material and literature of a promotional nature or
   in any case involving commercial solicitation pertaining to services, products or discounts offered by the
   Controller, as well as for conducting studies and surveys of the market, and elaborating related statistics;

4. communicate the Personal Data to MBE Worldwide S.p.A, Jonathan & Assist S.r.l, Eurocubia S.r.l,
   DireFareStampare S.r.l and Forama S.r.l. and CZ Mail S.r.l. (hereinafter the “Fortidia Group”)
   and to the MBE centers to send you, by any means of communication (fax, e-mail, text message, multimedia
   messaging service, paper-based mail, operator-assisted phone calls), advertising material of promotional nature
   or in any case involving commercial solicitation pertaining to services, products or discounts offered by the
   Fortidia Group and the relevant MBE center, as well as for conducting studies and surveys of the market, and
   elaborating related statistics.

The Personal Data collected may also be processed in the context of any corporate events (sale of the company or business units), due diligence or in the case of defence of a legal claim and the related preliminary activities.

4. Legal basis for processing Personal Data

The processing of your Personal Data for the purposes referred to in Section 3, a. is carried out in order to comply with your request and on the basis of a legitimate interest of the Controller, which business is inevitably linked to the quality of the services offered by its Websites, to the users’ interaction experience and to the satisfaction of their expectations. Any refusal to provide the Personal Data for the purposes set out above will make it impossible to send your contact request to the Controller and/or the selected MBE center.

The processing of Personal Data for the purposes referred to in Section 3, b., is necessary in order to perform the pre-contractual and contractual measures adopted upon your request when you ask for the services offered by the Websites. Any refusal to provide the Personal Data for the purposes set out above will make it impossible to use and enjoy the services above.

The processing of your Personal Data for the purposes referred to in Section 3, c. and d., is optional and is based on your freely given consent. Any refusal to provide the Personal Data for the purposes set out above will have the sole consequence of making it impossible for the Controller, the Fortidia Group and/or the selected MBE center to send you advertising and promotional messages, to conduct studies and surveys of the market, and elaborating related statistics.

In case of processing in the event of any potential corporate events (sale of the company or business units), due diligence or in the case of defence of a legal claim and the related preliminary activities, such processing will be carried out on the basis of legitimate interests of the Controller in the continuation of its commercial activities and for the protection of its rights.

5. Modalities of processing of Personal Data   

The processing will be carried out with the assistance of both automated instruments and on paper suitable for guaranteeing the security and confidentiality of Personal Data, this to collect, consult, store, manage, extract and transmit the Personal Data.

6. Recipients of Personal Data

The Personal Data will be disclosed to the persons authorized for the processing within the Controller’s staff.

The Personal Data may be disclosed by the Controller solely and exclusively for the purposes indicated and where necessary, to the following categories of subjects:

1. agents or collaborators of the Controller who are located within the territory of the European Union;
2. MBE centers that are located in Italy and which may process your Personal Data to carry out the services you
   requested and any ancillary activities (e.g. invoicing) and for marketing purposes where the relevant consent
   has been obtained;
3. service providers for marketing activities;
4. Fortidia Group companies as specified above, including – as of the date of this privacy notice – MBE Worldwide
   S.p.A., Jonathan & Assist S.r.l.; Eurocubia S.r.l.; DireFareStampare S.r.l., Forama S.r.l. and CZ Mail
   S.r.l.
5. consultants for accountancy, administrative, legal, tax and financial matters;
6. where required, the competent judicial authorities;
7. where required, public administrations and supervisory and control authorities.

Personal Data will not be publicly disclosed.

Entities belonging to the categories listed above, may act, as the case may be, as data processors (and in this case they will receive appropriate instructions from the Controller) or as autonomous data controllers. In the latter case, the Personal Data will be communicated only with the express consent of the data subjects,  except where the communication is mandatory or necessary pursuant to the applicable law or for the pursue of purposes for which the consent from the data subject is not required.

The Controller also have the right to transfer your Personal Data to third countries. Transfers of Data outside the European Economic Area are subject to a special regime pursuant to the GDPR, and are only made in respect of countries that ensure an adequate level of personal data protection, on the basis of an adequacy decision of the Commission or where adequate safeguards have been adopted (including the standard contractual conditions provided by the European Commission), provided that the data subjects have enforceable rights and effective judicial remedies.

7. Cookies

The Controller may use “cookies” within the Websites (i.e. text files sent and stored on users hard disk to be then retransmitted during the next visit of the same Websites), or other similar tools in order to facilitate the use of services requested by the user himself, as well as the user’s collection of information, the navigation of the Websites and the choices and preferences expressed on products/services. The user may revoke at any time the authorization granted and oppose to the use of cookies by selecting the appropriate settings on its Internet browser. For more information on how to disable cookies read our Cookies Policy

8. Retention of Personal Data

Personal Data will be stored, in compliance with the applicable law, for a term not exceeding what is necessary to pursue the purposes for which they are processed, save for the right to withdraw the consent at any time where it constitutes the legal basis for the processing.

The criteria for determining the storage period of the Personal Data takes into account the allowed processing period and the applicable laws on the statute of limitation of rights and legitimate interests of the data subject where they are the applicable legal basis for processing.

Subsequently, the Personal Data will be deleted, aggregated or anonymized.

9. Rights of the data subject

At any time, you will be entitled to:

1. obtain confirmation from the Controller as to whether your Personal Data is being processed, and where that is
   the case, to access to the personal information pursuant to art. 15 of the GDPR;
2. obtain the rectification of inaccurate Personal Data concerning you, or, taking into account the purpose of the
   processing, the integration of incomplete Personal Data;
3. obtain the erasure of your Personal Data, where one of the grounds under art. 17 of the GDPR applies;
4. obtain the restriction of processing of your Personal Data, where one of the cases under art. 18 of the GDPR
   applies;
5. object to the processing of your Personal Data on grounds relating to your particular position, where
   applicable;
6. receipt in a structured, commonly used and machine-readable format Personal Data concerning you and provided by
   you, as well as to transmit those Personal Data to another controller, in the cases and within the limits
   referred to in art. 20 of the GDPR, where applicable.

You also have the right to withdraw your consent to the processing of your Personal Data (where given) at any time, without prejudice to the lawfulness of the processing based on your consent before its withdrawal. You will have the possibility to opt-out from marketing via email by clicking on the relevant “unsubscribe” link.

According with the GDPR, the Controller may not charge for complying with any of the requests mentioned in this paragraph, unless they are clearly unfounded or excessive and repetitive. Should you request more than one copy of your Personal Data or in cases of excessive or unfounded requests, the Controller may:
(i) charge a reasonable expense, considering the administrative costs incurred to fulfil the request; or (ii) refuse to fulfil the request. In these cases the Controller will inform you of the costs before fulfilling the request.

The Controller may ask for further information before fulfilling the requests if it needs to verify the identity of the person who has made them.

Without prejudice to any administrative or legal remedy, you also have the right to lodge a complaint to the relevant supervisory Authority (for Italy: the “Garante per la protezione dei dati personali”), if you believe that processing of your data is in breach of the GDPR. More information is available on the website
https://www.garanteprivacy.it/en/home_en

In any case, the Controller is interested in knowing the reasons for the complaint and requests that you use the above contact methods before turning to the authorities, in order to prevent and resolve any disputes, amicably and promptly, with the greatest courtesy, professionalism and discretion.

For more information about the provisions contained in Articles from 15 to 22 of the GDPR, click on the following link:

http://eur-lex.europa.eu/legal-content/IT/TXT/PDF/?uri=CELEX:32016R0679&from=it

10.  Contacts for the exercise of the rights of the data subject and for further
    information

With respect to the exercise of your rights in relation to the purposes as per Section 3 above and/or to obtain any type of information you may need in relation to the Controller pursuant to this privacy notice, you can send a written communication to Sistema Italia 93 S.r.l. (Fiscal Code and VAT number 10697630159), with registered office in Milan, Viale Lunigiana 35-37, or a fax by dialling 02 67625625 or an email to
privacy@mbe.it.

11. Changes to this privacy notice

This privacy notice will be valid as of the date indicated below. It is advisable to regularly monitor this privacy notice by visiting the Websites in order to keep up to date with any future changes.

PRIVACY NOTICE
(Commercial communications carried out through call center)

Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 concerning the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter, the “GDPR”), we hereby provide the following notice regarding the processing of personal data of natural persons whose telephone numbers, taken from public directories, are not included in the Public Register of Objections and whose data are collected during phone calls (hereinafter, the “Prospect”).
These individuals may be contacted in connection with (i) the proposal of a commercial affiliation with MBE and/or (ii) the offer of products and services provided by MBE or by the stores owned by independent third-party entrepreneurs operating under the MAIL BOXES ETC. brand (hereinafter, “MBE Affiliates”), under a commercial affiliation agreement in Franchising, where shipping, communication, graphic and printing services are primarily offered (hereinafter, “MBE Centers”).
This notice supplements the short privacy notice orally provided by the telephone operator to the Prospect at the beginning of the call.

1. Data controller

The Data Controller is Sistema Italia 93 S.r.l. (Tax Code and VAT No. 10697630159), with registered office in Milan, Viale Lunigiana 35–37, Tel. +39 02 676251, Fax +39 02 67625625 (hereinafter, the “Controller” or “MBE”).

2. Categories of personal data processed

Within the scope of the processing activities, the following categories of personal data relating to the Prospect may be processed, whether provided directly or otherwise collected by the Controller:
Identification data and telephone number, where such data are present in public telephone directories or other publicly accessible sources and are usable due to the absence of registration in the Public Register of Objections;
The e-mail address provided by the Prospect in the event that he/she (i) requests to schedule an appointment with MBE and/or with an MBE Center, or (ii) gives consent to receive MBE commercial communications and to participate in market research activities;
Any other personal data communicated to the operator during the telephone call.

3. Purpose, Legal basis of processing, and Consequences of failure to provide personal data

The personal data of the Prospect may be processed for the following purposes:

3.1. Telephone contact with the Prospect

The personal data of the Prospect will be processed in order to:
-Verify the above-mentioned telephone numbers against the Public Register of Objections; and subsequently
-Contact the remaining numbers (relating to Prospects) by telephone for the purpose of (i) proposing a commercial affiliation with MBE, and/or (ii) promoting the products and services offered by MBE or by MBE Centers.
The processing of data for this purpose is carried out pursuant to Article 130, paragraph 3-bis of Legislative Decree No. 196/2003, as amended by Legislative Decree No. 101/2018, which permits the “sending of advertising material or direct sales, or the performance of market research or commercial communication” using the telephone for subscribers listed in publicly available directories who have not exercised their right to object by registering in the Public Register of Objections.
The processing for this purpose is also carried out based on the legitimate interest of MBE in expanding its network of Franchisees and fostering the growth and development of existing MBE Centers.
The Prospect may object to the processing of his/her personal data for this purpose at any time, either during the call or by sending, without any formalities, a written communication to the contacts specified under paragraph 9 (“Contacts for the exercise of data subject rights and for further information”) below.

In the event of an objection, the telephone number of the Prospect will be included in the Controller’s internal blacklist, that is, the list of individuals who cannot be contacted by MBE for commercial purposes. The inclusion in the blacklist represents the best protection of the Prospect’s interests and is carried out on the basis of the legitimate interest of the Controller to ensure compliance with the Prospect’s will not to receive future commercial calls.

In such cases, the only consequence for the Prospect will be the inability to receive proposals for commercial affiliation with MBE and/or information on the products and services offered by MBE Centers via telephone.

The Prospect may also register at any time, and free of charge, in the Public Register of Objections.
For further information on registration procedures, please visit:
http://www.registrodelleopposizioni.it/it/abbonati/home-abbonato

3.2. Scheduling appointments with MBE and/or an MBE Center

The Prospect’s personal data may be processed for the purpose of scheduling an appointment with MBE and/or the MBE Center whose products and services are of interest to the Prospect.
The processing for this purpose will be carried out on the basis of the pre-contractual request made by the Prospect at the time he/she asks the telephone operator to schedule the appointment.
Providing personal data for this purpose is optional, but failure to do so will make it impossible for the Prospect to obtain an appointment with MBE and/or the MBE Center of interest during the call.

3.3. Marketing purposes

The Prospect’s personal data may also be processed for the purpose of sending, through any means of communication (fax, e-mail, SMS, messaging services, postal mail, telephone calls with operator, or any other means), advertising and informational material of a promotional or commercial nature, as well as for conducting studies, surveys, and market statistics (hereinafter, “Marketing Communications”).
Providing data for this purpose is optional, and failure to do so will only result in the Controller being unable to send Marketing Communications to the Prospect.

If the Prospect has given consent for this purpose, he/she remains free to withdraw such consent at any time, in whole or in part, with respect to one or more communication channels used by MBE, by sending a written communication to the contacts indicated in paragraph 9 (“Contacts for the exercise of data subject rights and for further information”).

3.4. Additional processing activities

Personal data may also be processed in the context of corporate transactions (such as company or business unit transfers), due diligence activities, defense of legal claims, or related preparatory activities.
Such processing is carried out on the basis of the Controller’s legitimate interest in continuing its business operations and protecting its rights.

4. Methods of processing and data retention period

The processing of personal data will be carried out both manually and by means of automated tools, with logic strictly related to the purposes indicated above and, in any case, in a manner that guarantees the security and confidentiality of the data.

Personal data collected from public telephone directories and other publicly accessible sources will be retained for the time strictly necessary to verify the registration of the telephone number in the Public Register of Objections and, in any event, no longer than the time required to complete the telephone contact campaign;

Data processed for scheduling appointments (paragraph 3.2) will be retained for the time necessary to arrange the requested appointment and for any further related activities;
Data processed for marketing purposes (paragraph 3.3) will be retained until the withdrawal of consent, or, in the absence of such withdrawal, for a maximum period of 24 months from the date of consent;
Data included in the internal “blacklist” (paragraph 3.1) will be retained for the period strictly necessary to ensure that the Prospect is not contacted again for commercial purposes.

Once the respective retention periods have expired, the data will be deleted or irreversibly anonymized, unless their further retention is necessary to comply with legal obligations or to exercise or defend a right of the Controller.

5. Categories of data recipients

For the purposes indicated above, the Prospect’s personal data may be communicated to the following categories of recipients:
-Companies belonging to the MBE Worldwide S.p.A. group, to which MBE belongs, for internal administrative purposes and statistical analysis;
-MBE Affiliates (MBE Centers), if the Prospect has requested an appointment or expressed interest in their services;
-Third-party service providers that perform call center, marketing, IT, administrative, or organizational support activities on behalf of MBE (acting as Data Processors pursuant to Article 28 GDPR);
-Public authorities or bodies in fulfillment of legal obligations or in the exercise of their institutional functions.

The updated list of Data Processors and recipients is available upon written request to the Controller at the contact details indicated in paragraph 9 below.
Personal data will not be disclosed to the public.

6. Data transfer outside the European economic area

The Prospect’s personal data are normally processed within the European Economic Area (EEA).
Should the data be transferred to countries outside the EEA, such transfer will take place exclusively in accordance with the provisions of Articles 44–49 of the GDPR — that is, to countries recognized by the European Commission as providing an adequate level of protection, or subject to appropriate safeguards (e.g., Standard Contractual Clauses, Binding Corporate Rules, or other lawful transfer mechanisms).

A copy of the appropriate safeguards adopted, or the indication of the place where they have been made available, may be obtained by submitting a written request to the Controller using the contact details set out in paragraph 9.

7. Rights of the data subject

The Prospect, as Data Subject, may exercise the rights provided by Articles 15 to 22 of the GDPR, including:
-The right to obtain confirmation as to whether or not personal data concerning him/her are being processed, and, if so, access to such data (right of access);
-The right to obtain rectification of inaccurate data or completion of incomplete data (right to rectification);
-The right to obtain the erasure of personal data in the cases provided for by Article 17 GDPR (right to erasure);
-The right to obtain restriction of processing in the cases provided for by Article 18 GDPR (right to restriction of processing);
-The right to receive the personal data concerning him/her in a structured, commonly used and machine-readable format and to transmit those data to another controller (right to data portability);
-The right to object, at any time, to processing of personal data concerning him/her based on the legitimate interest of the Controller (Article 21 GDPR).

To exercise these rights, the Data Subject may send a written communication to the Controller at the addresses indicated in paragraph 9 (“Contacts for the exercise of data subject rights and for further information”).
The Data Subject also has the right to lodge a complaint with the competent Supervisory Authority (in Italy: the “Garante per la protezione dei dati personali”, www.garanteprivacy.it).

8. Updates to this privacy notice

MBE reserves the right to update this Privacy Notice at any time.
The updated version will always be made available at the time of the telephone call through a short notice provided by the operator and, upon request, in written form or through publication on MBE’s website at: https://www.mbe-franchising.it/en/legal-notice/

9. Contacts for the exercise of data subject rights and for further information

Any requests regarding the processing of personal data, the exercise of data subject rights, or any information concerning this notice may be addressed to:
Sistema Italia 93 S.r.l.; Viale Lunigiana 35–37, 20125 Milan, Italy; Tel. +39 02 676251; Fax +39 02
67625625; E-mail: mbeitaly@mbe.it; PEC: mbeitaly@legalmail.it