Privacy policy

This is a general Privacy Policy that applies to your visit of our website www.marco-loretti.com. If you are a resident of California, USA, please see California Privacy Policy available here.

The company NextLevel, d.o.o., Usnjarska cesta 18, 1275 Šmartno pri Litiji, VAT ID number: SI24280151, registration number: 8476845000 (hereinafter referred to as the “controller”), appreciates and respects the trust you have placed in us by submitting your personal data. We appreciate your privacy, so we will handle and use your data only in accordance with our Privacy policy, your preferences and currently applicable national and European legislation, internal acts and directives (Slovenian Personal Data Protection Act (hereinafter referred to as the “ZVOP-1”), Slovenian Electronic Communications Act (hereinafter referred to as the “ZEKOM-1”'), and the General Data Protection Regulation (hereinafter referred to as the: GDPR)).

Controller information

The controller of personal data obtained on the www.marco-loretti.com website is NextLevel, d.o.o. which has complete control over their processing. We will protect your personal data with the most advanced technical, administrative and physical safety measures, which protect your personal data from unauthorised third parties or their disclosure, use or modification.

 

Statement of personal data protection

As a personal data controller, NextLevel, d.o.o. undertakes to process, store and protect your personal data in accordance with the highest security standards. The data will be carefully protected against misuse, disposal, unauthorized use, falsification and loss. Personal data will be used to process your orders, send electronic newsletters or communicate through other channels in accordance with the purpose for which they have been obtained. We will not forward your personal data to unauthorized persons and other third parties. The exception is trusted partners, contractual processors with whom we have previously concluded a contract of securing, protecting and legally compliant processing of data. We undertake to make sure that the collected data will be used only in accordance with the purpose for which you have given us consent or which is in the legitimate interest of the user and the provider.

Privacy Policy applies to all data NextLevel, d.o.o. receives through various communication channels and is not only limited to personal data obtained through the www.marco-loretti.com website but also covers data collected through sweepstakes, telephone, e-mail, etc.

 

Ways of collecting personal data

We may collect your data:

  • if you sign up for the e-newsletter. By signing up for e-newsletter, the user agrees that the data controller sends promotional material, imaging materials, advertisements, campaigns and all other news about current offers, promotions, prices. We recommend users to sign up for the e-newsletter as this enables them to access additional discounts;
  • upon purchase/order made through telephone, website or any other communication channel. In this case, all the necessary information is collected for the quality and smooth performance of the contract;
  • in the case of sweepstakes. In this case, personal data is collected that may be subject to conditions other than those specified in our General terms and conditions and Privacy policy. For each sweepstake, additional conditions apply. Please read them carefully;

In the case of online purchase and your explicit consent to receive direct, personal communication. When buying in our online store, you may confirm that you agree and fully accept the General terms and conditions and explicitly agree to receive advertising and marketing content.

 

The purpose of collecting personal data

 Order and processing

In case of an online order at www.marco-loretti.com, we will use the entered information (e-mail, mobile number, etc.) to arrange the delivery of the ordered products, to obtain additional information from the user, or to inform the user regarding order status. In this case, the data shall be used solely for the purpose of quality and comprehensive execution of the contract of sale. These personal data are also indispensable for the final performance of the delivery, so they may also be communicated to the delivery service or logistics centre. As the controller of such personal data, NextLevel, d.o.o. shall use all data you have used to fill out the form upon the check-out and which form the basis for drawing up the contract of sale.

Direct, personalised communication with customers

  • E-newsletter – e-newsletter will be sent to you if you have provided us with your email address and explicit permission to agree to receive advertising content, relevant provider’s notifications, special offers, current offers, promotional materials, and other personalised communications via e-mail, which the Controller considers relevant for the direct marketing of the products.
  • Consent for personal, personalized communication – if you have given consent at the website in any form for direct, personalized communication, the controller may send you relevant information via phone, e-mail, SMS/MMS, mail, printed materials, and all other communication channels.
  • If you have made a purchase in the www.marco-loretti.com online store and have agreed to the General Terms and Conditions and provided us with your e-mail address and mobile number (SMS), we may send you e-mails offering similar products or services in accordance with our legitimate interest. If you want to withdraw the consent, you can do so based on the first e-mail you receive.
  • On the basis of our legitimate interest, we may contact you on the basis of the data contained in the publicly available general directory.
  • On the basis of legitimate interest, we can send you printed materials.

To make your shopping experience as best as possible, we may process your personal data also by personalizing the sent content, based on which you receive offer tailored to your needs. The offer is designed based on your past wishes and purchases and is based on our legitimate interest. Personal data may be used for segmentation and targeted advertising. Technologies enabling targeted advertising and the preparation of tailored, personalized offers are for example cookies. They allow the content to be adapted to the needs and wishes of the user who thus gets better offers on social networks and can access relevant data on browsers more quickly. They also allow us to track traffic from different sources to the website and send data to trusted business partners (social networks, search networks etc.).

In case the purpose of the use of personal data is direct marketing, for which you have explicitly given us consent, the controller will mark any such messages as advertising and the user will always be able to independently unsubscribe from receiving such advertising messages.

 

Complete customer support

To resolve any ambiguities and obtain information regarding products, prices, orders and other information, you may contact us at any time via online chat, e-mail [email protected] or any other communication channel available at that moment. Personal data you provide to us (subscriber information, order number, order history, account number, etc.) will be processed solely to resolve your request and ensure quality treatment. The basis of data processing for this purpose is a purchase contract, the execution of which requires the processing or legal obligation of both parties in a business relationship.

 

Data analysis

The analytical data we obtain from your visit to the website or by you communicating your data to us personally may also be used to research and analyse these data. In most cases, the data processed for research purposes are anonymised as research is conducted based on pseudonyms; however, in rare cases, they are not. The purpose of such processing is a comprehensive understanding of our customers’ needs and desires, identifying market trends, providing relevant information to the customer, developing, and refining products and services, legitimate interest, improving user experience, displaying personalised ads, and improving the technology and structure of the website.

 

Types of personal data we collect

The personal data you may provide us with in accordance with the purpose of each form or various other methods of collecting personal data are as follows:

  • Email,
  • Name,
  • Surname,
  • Address of residence,
  • Post office and ZIP,
  • Country,
  • Telephone number (stationary or mobile),
  • Name, address and tax number of the company.

Collecting your personal data is based on the digital platform or your use thereof (registration, order, forms, analytic tools). Through your browser, you send your personal data to our server, including the IP address, the date of visit, the time of visit, the session time limit on the website and the reference URL, and information about your gender, device, operating system, and browser.

In the case of parties other than the data subject, for example in cases where a legal entity provides information about certain individuals to the controller, they guarantee to have obtained an appropriate consent from the data subject for the processing of data by the controller. In accordance with Article 14 of the GDPR, the controller must provide such data subject with information and all data in accordance with the Provider’s Privacy policy and General terms and conditions.

Some personal and anonymous statistics are collected through cookies technology and similar mechanisms. You can read more about the cookie policy at www.marco-loretti.com.

In the case of telephone orders and communications (inbound and outgoing calls), the conversation shall be recorded in accordance with Paragraph 7 of Article 147 (Confidentiality of Communications) of the ZEKOM-1, since said provision allows the recording of communications and related traffic data in the context of a legitimate commercial practice in order to provide a proof of the market transaction or any other business communication. The Parties will be informed in advance of the recording, its purpose, and the period for which the recording will be stored (they will be notified thereof by a call agent in person or by an automatic answering machine). The recorded communication must be deleted without delay and at the latest by the end of the period in which an individual transaction may be challenged. All recordings will be protected carefully and processed in accordance with the General terms and conditions and Privacy policy. Via the telephone, we may collect data that is strictly necessary for us to realize the order, resolve bureaucratic issues and verify information, and, in the case of your explicit permission, for personal communication and marketing activities.

 

Sharing personal data with third parties

Third parties who are our contractual processors

We do not share personal data with unauthorised third parties, and your personal data are protected according to the highest safety standards. We appreciate the trust you have shown to us by providing your personal data, so in some instances, we may send it only to trusted business partners, e.g. contractual processors with whom we have internal contracts for the processing and protection of your personal data. This concerns legal entities that take care of the delivery of your products (own warehouse, logistics centre, delivery service), financial institutions (order payment – banks) and individual partners who provide direct, personal communication services for us. Only specific personnel responsible for service provision has access, and the confidentiality of personal data is binding upon them even after the termination of the employment contract or function.

Social, search and other online networks

Various plugins of social, search and other online networks are installed on the www.marco-loretti.com website which use the cookies technology to collect anonymised data through the browser and send such data back to the server of those providers (such as Facebook, Google, etc.). If you use these networks, data on your activity and interests may also be available to these networks since you have agreed to their terms and conditions and privacy policies. If you want to avoid submitting your data, you can log out of these online networks and stop using them.

Your rights regarding the processing of personal data

Pursuant to the first paragraph of Article 15 of the GDPR, the data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are processed, and, where that is the case, access to the personal data and the following information:

  • the purpose of the processing;
  • the categories of personal data concerned;
  • the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
  • where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
  • the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
  • the right to lodge a complaint with a supervisory authority;
  • all available information regarding the source of personal data, where these are not collected from the data subject;
  • the existence of automated decision-making, including the profiling referred to in the first and fourth paragraphs of Article 22 of the GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

Pursuant to Article 16 of the GDPR, the data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her.

Pursuant to Article 17 of the GDPR, the data subject shall have the right to obtain from the controller without undue delay the deletion of personal data concerning him or her. This shall be possible where personal data are no longer needed for the purpose for which they were collected or otherwise processed; when the data subject revokes the consent based on which the processing is carried out pursuant to item a of the first paragraph of Article 6 or item a of the second paragraph of Article 9 of the GDPR, and where no other legal basis exists for the processing; when the data subject objects to processing pursuant to the first paragraph of Article 21 of the GDPR, and there are no overriding legitimate grounds for processing the data, or the data subject objects to processing pursuant to the second paragraph of Article 21 of the GDPR; where personal data have been processed unlawfully; where personal data are to be erased to fulfil a legal obligation under Union or Member State law that applies to the controller, or where personal data have been collected in relation to the offer of information society services referred to in the first paragraph of Article 8 of the GDPR.

Pursuant to Article 18 of the GDPR, the data subject shall have the right to obtain from the controller the restriction of processing where the data subject disputes the accuracy of the data for a period allowing the controller to verify the accuracy of personal data; where the processing is unlawful and the data subject opposes the deletion of the personal data and instead requests a restriction of their use; when the data controller no longer needs them for processing purposes but are required by the data subject to establish, exercise or defend legal claims, or when the data subject has raised an objection regarding the processing pursuant to the first paragraph of Article 21 of the GDPR, until it is verified that the legitimate grounds of the controller override the grounds of the data subject.

Pursuant to Article 20 of the GDPR, the data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to the controller, in a structured, commonly used and machine-readable format and shall have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where processing is based on the consent and where processing is carried out by automated means.

Pursuant to the first paragraph of Article 21 of the GDPR, the data subject shall have the right to object the processing of personal data. The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to the processing of personal data concerning him or her which is based on item e or f of the first paragraph of Article 6 of the GDPR, including profiling based on those provisions. If the controller fails to demonstrate compelling legitimate grounds for processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims, the controller may no longer process the personal data.

Pursuant to the second paragraph of Article 21 of the GDPR, where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to the processing of personal data concerning him or her for such marketing, including profiling, to the extent that is related to such direct marketing.

Pursuant to the third paragraph of Article 21 of the GDPR, the data subject shall have the right to object to the processing for direct marketing purposes and the further processing of personal data for such purposes.

Pursuant to the first paragraph of Article 22 of the GDPR, the data subject shall have the right to contest the use of his or her personal data based solely on automated processing, including profiling, which would have a significant impact on him or her and have legal effects in relation to him or her.

Pursuant to the third paragraph of Article 7 of the GDPR, the data subject shall have the right to withdraw his or her consent to the use of personal data at any time.

You may withdraw your consent to the processing of personal data that you provide to the controller, NextLevel, d.o.o., for one or more communication channels or to access and supplement personal data by:

  • e-mail. Contact us at [email protected],
  • via the link for unsubscription that is in the header or footer of each promotional message. This way you can withdraw your consent for direct, personal communication for the communication channel in question.

We will no longer send you electronic messages (e-mails, SMS, etc.) and other direct, personalised communication when we receive the request for consent withdrawal. In the event of a request for deletion of personal data, access to personal data, consent withdrawal, or in connection with the exercise of other rights, we will do everything in our power to comply with your wish within fifteen (15) days at the latest. After you withdraw the consent for personal, direct communication via one or more communication channels, we will no longer send you promotional messages or we will delete all your personal data.

The controller will delete your personal data immediately after the expiry date for the specific purpose for which you have previously given your consent, or upon your express request for consent withdrawal or deletion of personal data.

 

The Privacy Policy was adopted on 16 October 2020 and has been in force since then.