PRIVACY NOTICE

Issued on March 31, 2025, by N-and Italia S.r.l., pursuant to the European GDPR Regulation 2016/679 and Legislative Decree 196/2003 as amended by Legislative Decree 101/2018

In compliance with the obligations arising from national legislation (Legislative Decree 196/2003 and Legislative Decree 101/2018 “Italian legislation on the matter and Provisions of the Privacy Guarantor”) and community legislation (Regulation (EU) 2016/679 of 27 April 2016 known as G.D.P.R. (General Data Protection Regulation), the General Data Protection Regulation (hereinafter also referred to as “GDPR”, already in force and applicable from 25 May 2018), N-and respects and protects the privacy of registered and non-registered users, making every possible and proportionate effort to protect their data, according to the purposes and principles defined in this Policy, and in the Terms of Use, also these Terms of Service.

Pursuant to Art. 8 of the GDPR – which is reported in full below – natural persons who are at least 16 (sixteen) years may use the specific functions of coffee cApp, in particular the payment and value-added services connected to registration; N-AND Italia S.r.l. reserves the right to carry out random checks on its own initiative and/or on the basis of specific reports, regarding the age of its users and in the event of violations of the Terms of Service, in particular in the event that a registered user is under 16 years of age, it may, unless – as a last resort – it manages to recover parental consent, immediately suspend the account, and/or if it is not possible to obtain parental consent, delete the account created in violation of the rule on the minimum age for registration, reserving the right to report to the Guarantor Authority and the postal police any behavior that does not comply with the Terms of Use (Terms of Service).

[Article 8 - Conditions for consent of a child in relation to information society services

  1. Where Article 6(1)(a) applies, in relation to the offer of information society services directly to a child, the processing of personal data of a child shall be lawful where the child is at least 16 years old. Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child. Member States may provide by law for a lower age for those purposes, provided that such a lower age is not lower than 13 years.
  2. The controller shall make every reasonable effort to verify in such cases that consent is given or authorised by the holder of parental responsibility over the child, taking into account available technology.
  3. Paragraph 1 shall be without prejudice to the general provisions of the contract law of the Member States, such as the rules on the validity, formation or effectiveness of a contract in relation to a minor.]

1. Data Controller

N-and Italia S.r.l. with VAT number IT04327810166 is the Data Controller of the data collected through the application for devices with an iOs, Android operating system, called “coffee cApp” of which it is the owner and of which it takes care of development, publication and updating on the following stores: Play Store, Apple Store, Huawei Gallery. N-and Italia S.r.l. has its operational headquarters in Via delle Gere 15, 24040 Pognano (BG) – Italy. Any requests for information and/or clarifications regarding the processing, methods of storage and rectification and deletion as well as requests for data portability may be requested without particular formalities by sending an email to the following address: coffeecapp@n-anditalia.com

2. Processing carried out and purposes

N-and Italia S.r.l. (hereinafter also referred to for brevity as “N-and Italia”), wishes to inform you that the personal data entered by you for the purposes of registering for the coffee cApp application (for example, mobile telephone number and email address, in addition to other data requested) will be collected and processed for the following purposes:

  1. for the provision of the payment service for the sale of products present in vending machines, better known by the name of the application called "coffee cApp" and any other functionality related to the same service: by way of example but not limited to, the communication of information - of any nature - relating to the products present in the distributors used by the user, the management of requests for information or assistance initiated by users of the service, for example the verification of a credit or the presence or absence of a product and the relative cost, information also of a commercial and promotional nature on the products present in the specific distributors where the users go and made available in the public and/or reserved sections present in the coffee cApp application, which may be prepared directly by N-and Italia and/or in collaboration with the companies that manage the automatic distribution service in the territory;

  2. for sending informative and promotional communications, including commercial ones, advertising material and/or offers of goods and/or services, by any means (known and unknown) with the exception of what is made available within the coffee cApp application referred to in point a. above, including, by way of example and not limited to, post, internet, telephone, e-mail, MMS, SMS by N-and Italia itself and, subject to obtaining appropriate consent, by those third-party companies that operate in the territory by providing automatic distributors/vending machines in the place where the user uses coffee cApp;

  3. subject to obtaining appropriate consent, if required by current legislation, for the processing and completion of statistical and market studies and research, for the analysis of tastes, preferences, habits, needs and consumer choices, as well as for the detection of the degree of satisfaction with the quality of the products and services offered by the Company.

The user will be asked to express his/her consent to the processing in the event that this is required by the provisions of the GDPR. Failure to consent to the purposes indicated in points (b) and (c) does not affect the possibility of using the service referred to in point (a).

In relation to the indicated purposes, the processing of personal data will be carried out using suitable paper and/or electronic tools, with logic strictly related to the purposes themselves and, in any case, capable of guaranteeing the security and confidentiality of the same.

The processing described above involves the use of automated decision-making processes performed via an IT system that allow the user to be profiled.

The consequences linked to such processing are represented by the receipt of targeted commercial communications and elaborated on previous choices made by the user in using coffee cApp.

3. Legal basis of the processing

The processing is carried out on the basis of the existence of legitimate interest as there is a relevant and appropriate relationship between the interested party and the data controller justified by the user's registration specifically aimed at using the service offered by coffee cApp.

4. Provision of data

The provision of personal data is optional. Any refusal or the provision of inaccurate and/or incomplete information may make it impossible:

  1. to provide the payment service for the sale of products, called the so-called “coffee cApp” service, pursuant to the previous paragraph 2 (a);

  2. to send informative and promotional communications, including commercial ones, advertising material and/or offers of goods and services, by any means other than the coffee cApp application, pursuant to the previous paragraph 2 (b);

  3. to develop and carry out statistical and market studies and research, to analyse tastes, preferences, habits, needs and consumer choices, as well as to detect the level of satisfaction with the quality of the products and services offered by the Company, pursuant to the previous paragraph 2 (c).

The activities referred to in the previous paragraph 2 (b) and (c) may be carried out only after obtaining your express, free and specific consent, given for each purpose of the processing.

5. Communication of data and scope of dissemination

The data may be communicated to the following categories of subjects that N-and Italia uses to carry out some activities functional to the provision of the service:

  1. any subjects that provide the Company with performances or services that are instrumental to the purposes indicated above, such as, by way of example, parent companies, subsidiaries, affiliates and/or associated companies, subjects, entities and/or companies that manage and/or participate in the management and/or maintenance of the websites and electronic and/or telematic tools used by the Company;

  2. companies that own and/or manage vending machines;

  3. suppliers, contractors, subcontractors, banks and/or insurance companies or, more generally, other subjects and/or entities that provide (on behalf of the Company or independently) the activities referred to in the previous paragraph 2 or activities connected or instrumental to them;

  4. consultants who assist the Company in various capacities with particular reference to legal, tax, social security, accounting and organizational aspects;

  5. any other subject to whom the data must be communicated based on an express provision of law.

6. Communication and transfer of data

Upon collection of the express consent of the interested party, the data may be communicated and transferred to third-party companies that directly provide the product supply service through Automatic Distributors/Vending Machines in the territory, with the same processing purposes declared in this information by N-and Italia.
The list of these companies with the related Data Processors is constantly updated and can be found by sending an email to coffeecapp@n-anditalia.com

7. Transfer of users' Personal Data outside the EU

Personal Data may be transferred outside the European Union to countries where Automatic Distributors/Vending Machines will be present in which it will be possible to use coffee cApp. The updated list of non-European countries to which the data may be transferred can be requested by sending an email to coffeecapp@n-anditalia.com

8. Data Processing and Storage Time

The data will be stored for the time necessary to carry out the purposes indicated above in compliance with the terms of the law, for the period corresponding to fiscal, accounting, administrative needs and to document our activity, as well as to respond to your data recovery needs. The Data Controller, in any case, will process the Personal Data for a period of time not exceeding that necessary to achieve the purposes for which the personal data are processed, or for a longer period, for purposes permitted by law, and in any case deleted without unjustified delay.

9. Rights of the interested party

Pursuant to the GDPR, the interested party has the right to:

10. DATA PROTECTION OFFICER (DPO)

We hereby inform you that the Company has appointed a Data Protection Officer also known as the Data Protection Officer (DPO).

DPO Email: dpo@n-anditalia.com

For any reports, you can write to the DPO via email or traditional mail by addressing the request to the address of the Undersigned - to the kind attention of the DPO of N-And Italia S.r.l.

11. EXERCISE OF THE RIGHTS OF THE INTERESTED PARTY

N-and Italia and/or third-party companies to which the interested party's data have been legitimately transferred, will interrupt the processing, without delay, when the interested party receives a request to revoke the consent previously expressed. This revocation may also be made explicit in relation to profiling processing only (par. 2. (c)) while keeping the service active. These rights may be exercised by sending an email to coffeecappATn-anditalia.com or by writing to N-and Italia S.r.l. - Via delle Gere 15, 24040 Pognano (BG) – Italy, or to one of the companies to which the interested party's data has been transferred, subject to his/her explicit consent.


***

CONSENT REQUESTS

Having read the information above, I expressly consent to the processing of my personal data in the manner indicated above and for the following purposes: