Privacy policy

NOTICE ON THE PROCESSING OF PERSONAL DATA
pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”)

PURPOSE OF THIS NOTICE

This privacy notice (the “Privacy Notice”), provided pursuant to Articles 13 and 14 of the GDPR, describes the processing of personal data carried out jointly by Maxima S.r.l. and Calicantus S.r.l. in connection with the management of certain e-commerce activities and the coordinated management of Customer Service on the e-commerce website dedicated to the M_M brand, accessible at www.mm-official.it (the “Website”).

This Privacy Notice is addressed to users who place orders through the Website, as well as users who request assistance by contacting Customer Service (hereinafter “Data Subjects”).

In managing the online sale of products through the Website, MAXIMA S.r.l. and Calicantus S.r.l. collaborate, within their respective areas of responsibility, in providing certain services to users and jointly determine the purposes and essential means of the processing of personal data.

With regard to such processing, Maxima S.r.l. and Calicantus S.r.l. act as Joint Controllers pursuant to Article 26 of the GDPR and have established, through a specific joint controllership arrangement, their respective tasks and responsibilities for fulfilling the obligations laid down by applicable personal data protection legislation. Pursuant to Article 26(2) of the GDPR, the essence of the arrangement is set out in section 10.

This Privacy Notice does not cover processing carried out separately by each Party as an independent Controller, for which Data Subjects will be provided with the information required by applicable legislation.


1. IDENTITY AND CONTACT DETAILS OF THE CONTROLLERS

The Joint Controllers, pursuant to Article 26 of the GDPR, are:

  • Maxima S.r.l., with its registered office in Reggio nell’Emilia (RE), Via G. Maramotti, 4 – 42124 (Tax Code/VAT No. 00145560355), email: maximasrl@legalmail.it (hereinafter also “Maxima”);

  • Calicantus S.r.l., with its registered office in Quarto D’Altino (VE), Via L. Mazzon, 30 – 30020 (Tax Code/VAT No. 03757590272), email: privacy@calicant.us (hereinafter also “Calicantus”);

hereinafter also jointly referred to as the “Joint Controllers”.


2. DATA PROTECTION OFFICERS AND PRIVACY CONTACTS

The Data Protection Officers (“DPOs”) can be contacted using the following details:

  • For Maxima, address: Via Pietro Giannone, 10 - 10122 Turin (Italy), dedicated email: dpo@mmfg.it

  • For Calicantus S.r.l.: nicola.ghinello@dpo-rpd.com


3. PURPOSES AND LEGAL BASIS OF PROCESSING

Maxima and Calicantus jointly determine the purposes and essential means of the processing necessary for the following purposes:

a) joint management of e-commerce activities on the Website carried out by Maxima and Calicantus.

With regard to Calicantus, the processing of the data of the User placing an order is based on the need to perform the sales contract or to take steps at the Data Subject’s request prior to entering into a contract, pursuant to Article 6(1)(b) of the GDPR.

With regard to Maxima, processing is based on its legitimate interest in managing the e-commerce activities falling within the joint project, consulting and updating the information necessary for the proper fulfilment of orders, and handling requests relating to the Products, pursuant to Article 6(1)(f) of the GDPR, subject to balancing those interests against the rights and freedoms of Data Subjects.

b) coordinated management of Customer Service.

Depending on the nature of the request, processing is based on:

  • the need to perform the sales contract or to take steps at the Data Subject’s request prior to entering into a contract, pursuant to Article 6(1)(b) of the GDPR;

  • compliance with applicable legal obligations, particularly those relating to consumer protection, the right of withdrawal and the legal guarantee of conformity, pursuant to Article 6(1)(c) of the GDPR;

  • where applicable, the Joint Controllers’ legitimate interest in properly handling requests, complaints and any disputes, as well as in establishing, exercising or defending their rights, pursuant to Article 6(1)(f) of the GDPR, subject to balancing those interests against the rights and freedoms of Data Subjects;

c) ensuring the availability and continuity of the transaction history required for Customer Service and the management of related cases, including in the event of system migration, replacement of a service provider or termination of the contractual relationship between the Joint Controllers.

Processing is based on the Joint Controllers’ legitimate interest in ensuring the continuity, traceability and proper management of Customer Service cases, as well as in protecting their respective rights, pursuant to Article 6(1)(f) of the GDPR, subject to balancing those interests against the rights and freedoms of Data Subjects and within the retention period specified in this Privacy Notice.

The personal data processing activities carried out for the purposes set out above are hereinafter collectively referred to as the “Joint Processing Activities”.

Processing carried out by each company for its own purposes falls outside the scope of joint controllership, as further detailed in section 9.


4. CATEGORIES OF PERSONAL DATA PROCESSED

In accordance with the principles of purpose limitation and data minimisation, Maxima and Calicantus may, as part of the Joint Processing Activities and to the extent necessary to achieve the purposes described in this Privacy Notice, process the following categories of personal data:

a) Sales Data, relating to orders placed through the Website and their fulfilment, including data relating to products purchased, shipments, deliveries, returns and refunds, processed for the purposes referred to in section 3(a) above;

b) Customer Service Data, relating to requests for assistance, complaints and other requests submitted by Data Subjects, as well as the management of related cases, processed for the purposes referred to in sections 3(b) and 3(c) above.

4.1 Sales Data

Specifically, Sales Data includes:

  • identification and contact details associated with the order, such as first name, surname, email address, telephone number, billing address and shipping address;

  • data relating to orders and products purchased, such as order number and date, products purchased, quantities, amounts, any discounts applied and order status;

  • data relating to shipments and deliveries, such as destination address, shipment identifier, tracking code, delivery status and date;

  • data relating to the processing of returns and refunds, such as order identifier, returned products, date and outcome of the return, credit note identification details, refund amount, date, processing status and general refund method, excluding full payment instrument details.

4.2 Customer Service Data

Specifically, Customer Service Data includes:

  • identification and contact details necessary to identify the user and link their request to the specific order;

  • order identification details and any further sales information necessary to handle the request for assistance;

  • data relating to requests for assistance and complaints, such as the subject and reason for the request, information and documents provided by the User, and the content of communications exchanged;

  • data relating to return or refund requests and the management of related cases, such as the reason for the request, information and documents provided by the user, the status of the request for assistance, any escalations, assessments carried out and their outcome;

  • data relating to ticket management, such as opening date, contact category and reason, acceptance for handling, assignment, status, activities carried out, case handling times and outcome;

  • data relating to escalations to Maxima, including information transmitted, assessments carried out and responses provided by Maxima or Calicantus, within their respective areas of responsibility.

The Joint Processing Activities do not envisage the collection of special categories of personal data pursuant to Article 9 of the GDPR or data relating to criminal convictions and offences pursuant to Article 10 of the GDPR. Data Subjects are therefore asked not to disclose such information in requests for assistance, complaints or documentation submitted through Customer Service. If such data is provided voluntarily, Maxima and Calicantus will assess its relevance and take the necessary measures to restrict access to and processing of such data or, where there is no valid legal basis or such information is unnecessary, to erase or redact it.

4.3 Nature of the provision of personal data

The provision of the personal data required to manage orders, shipments, deliveries, returns and refunds is necessary to enable the conclusion and performance of the sales contract. Failure to provide such data may make it impossible to place or fulfil an order.

The provision of the data required to handle requests for assistance, complaints and other requests addressed to Customer Service is necessary to enable the Joint Controllers to identify the Data Subject, link the request to the specific order and provide the requested response. Failure to provide the necessary data may prevent the request from being handled properly.

The provision of any additional information indicated as optional is at the Data Subject’s discretion, and failure to provide it will not affect order fulfilment or the handling of the request, unless such information is necessary in the specific circumstances of the case.


5. SOURCE OF THE DATA AND METHODS OF PROCESSING

Personal data is collected directly from the Data Subject through the Website and Customer Service channels. Additional data may be generated or obtained from the systems and parties involved in fulfilling the order, such as technology platforms, logistics operators and providers of sales-related services.

Processing is carried out using IT tools and, where necessary, manually, in accordance with the principles of lawfulness, fairness, transparency, data minimisation, accuracy, storage limitation, integrity and confidentiality. Technical and organisational measures appropriate to the risk are implemented, including restricting access to authorised persons only and to the information necessary for their respective activities.

The Joint Processing Activities described in this notice do not involve decisions based solely on automated processing that produce legal effects concerning the Data Subject or similarly significantly affect them.


6. RECIPIENTS OF THE DATA

Data may be processed, within the limits of their respective duties and operational needs, by:

  • employees and other personnel of the Joint Controllers who are authorised to process the data;

  • providers of IT, hosting and maintenance services, and e-commerce and Customer Service platforms and systems, appointed as processors where required;

  • logistics operators, carriers and parties involved in managing shipments, deliveries and returns;

  • consultants and professional advisers, as well as public authorities and parties entitled to receive the data under statutory provisions or orders issued by an authority.

The data is not made publicly available.


7. TRANSFERS OF DATA TO THIRD COUNTRIES

If data is transferred to countries outside the European Economic Area or to international organisations, the transfer will take place in accordance with Chapter V of the GDPR, on the basis of an adequacy decision or subject to appropriate safeguards, such as the standard contractual clauses approved by the European Commission, with supplementary measures where necessary. Information on the safeguards applied and how to obtain a copy may be requested using the contact details provided in this notice.


8. RETENTION OF PERSONAL DATA

Data is retained for as long as necessary to achieve the purposes for which it is collected and, subsequently, for the period necessary to comply with applicable obligations and protect the rights of the Joint Controllers and Data Subjects. In particular:

  • Sales Data relating to orders and their fulfilment is retained for 10 years from the completion of the last activity relating to the order, including any return, refund or assistance provided, in order to enable the handling of order-related requests, ensure the continuity of the transaction history and verify the proper performance of the relevant activities;

  • Customer Service Data, including data relating to requests, tickets and any escalations, is retained for the duration of the relationship and for the time necessary to handle and respond to the user’s requests, in order to ensure service continuity, reconstruct the activities carried out, handle any subsequent requests relating to the same case and verify the accuracy of the responses provided, subject to any need for further retention in connection with complaints or litigation;

  • if a request, complaint or case gives rise to a dispute or legal proceedings, the relevant personal data may be retained, with access restricted to authorised persons, for the entire duration of the dispute or proceedings and, following their resolution, for the applicable limitation period, taking into account any acts that interrupt or suspend that period.

Upon expiry of the applicable periods, the data is erased or irreversibly anonymised, unless further retention is required by law or for the handling of a dispute.


9. PROCESSING CARRIED OUT BY THE INDIVIDUAL CONTROLLERS OUTSIDE THE SCOPE OF JOINT CONTROLLERSHIP

This Privacy Notice governs the Joint Processing Activities described in section 3. Processing carried out by Calicantus and Maxima as independent Controllers remains separate from those activities and falls outside the scope of joint controllership.


10. ESSENCE OF THE JOINT CONTROLLERSHIP ARRANGEMENT

Maxima and Calicantus have defined their respective roles and responsibilities in a written arrangement. In summary:

  • the notice on the Joint Processing Activities is prepared jointly and is published and made accessible at data collection points and through Customer Service channels;

  • each Joint Controller ensures, for the activities within its responsibility, compliance with the principles of the GDPR, the security of processing, and the proper management of authorised persons and any processors;

  • the Joint Controllers cooperate in handling Data Subjects’ rights, personal data breaches, complaints and requests from the Supervisory Authority;

  • Calicantus is designated as the operational contact point for Data Subjects’ requests and coordinates their handling with Maxima, without prejudice to the Data Subject’s right to contact either Joint Controller;

  • each Joint Controller remains independently responsible for processing carried out outside the scope of joint controllership.

The essence of the arrangement may be requested from the Joint Controllers using the contact details provided in this notice.


11. RIGHTS OF THE DATA SUBJECT

At any time and free of charge, the user may exercise the following rights:

  • obtain confirmation as to whether or not personal data concerning them is being processed and, where that is the case, access the personal data and information relating to its processing;

  • obtain the rectification of inaccurate personal data and the completion of incomplete personal data;

  • obtain the erasure of personal data, except where its retention is necessary to comply with a legal obligation or for the establishment, exercise or defence of legal claims;

  • obtain restriction of processing in the cases provided for in Article 18 of the GDPR;

  • receive, in the cases provided for in Article 20 of the GDPR, the personal data provided to the Joint Controllers in a structured, commonly used and machine-readable format and, where technically feasible, have it transmitted directly to another Controller (data portability);

  • object, on grounds relating to their particular situation, to processing based on the Joint Controllers’ legitimate interests, pursuant to Article 21 of the GDPR;

  • withdraw any consent given at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

Requests may be addressed to either Joint Controller. For operational purposes, the designated contact point is Calicantus S.r.l., at the address indicated in section 1 “IDENTITY AND CONTACT DETAILS OF THE CONTROLLERS”. Maxima S.r.l. may also be contacted at the address indicated in section 1 “IDENTITY AND CONTACT DETAILS OF THE CONTROLLERS”.

The designation of the contact point does not restrict the right to exercise one’s rights against either Joint Controller.

If the Data Subject considers that the processing of their personal data infringes the GDPR, they also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or with the competent Supervisory Authority in the Member State of their habitual residence, place of work or place of the alleged infringement, without prejudice to any other administrative or judicial remedy.


12. UPDATES

This notice may be updated to reflect legislative, organisational or technical changes relating to the processing described. The updated version will be made available on the Website and at other relevant data collection points.


LAST UPDATED

This notice takes effect on 15/10/2026.