Legal

Privacy Policy

Privacy Policy pursuant to and for the effects of Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and of Italian Legislative Decree 101/2018

We wish to inform you that the legislation cited above provides for the protection of individuals through the protection of the data supplied. The data will be the subject of processing for the provision of the services offered by Garanteasy or by its Licensees (hereinafter, for brevity, “Licensees“) in absolute compliance with the legislation referred to above and with the obligations of ordinary confidentiality. The Garanteasy Services are provided through the technological Platform (hereinafter, for brevity, “Platform“) owned by Garanteasy S.r.l., with registered office at Via Pio XI, 1, 20123 Milano, Italy, VAT no. IT08055550969, share capital €559,801.00 (hereinafter, for brevity: “Garanteasy“). Pursuant to the legislation cited above, therefore, we provide you with the information you find in this Privacy Policy.

Purposes of the processing for which the Data are intended

The processing of the Data requested from you is carried out with the following methods and purposes:

  • creation of an account to access the services by means of a username and password (hereinafter and for brevity: “Account“);
  • creation of one or more personal profiles, containing your minimum data, useful to make the provision of the Services simpler; Data such as: e-mail, telephone and address (hereinafter and for brevity: “Profile“);
  • digital storage of till receipts, receipts or invoices (hereinafter, for brevity, “Proof of Purchase or Proofs of Purchase“) in order to activate the Warranties;
  • digital storage of images, technical information and manuals (hereinafter, for brevity, “Technical Data Sheets“) of your products (hereinafter, for brevity, “Products“) in order to facilitate the identification of the Products subject to warranty or extra cover;
  • digital storage of the data of the Points of Sale where you made your purchases (hereinafter, for brevity, “Point of Sale or Points of Sale“) in order to facilitate the management of the warranty in the event of defects;
  • digital storage of information on legal guarantees, commercial guarantees, after-sales support extensions, insurance policies etc. (hereinafter, for brevity: “Warranties“) relating to the Products in order to calculate the expiry dates, identify the limitations and the activation methods;
  • consultation of the stored data, meaning Account, Profile, Proofs of Purchase, Technical Data Sheets, Warranties, Cover Extensions, Points of Sale, Reviews, Complaints, (hereinafter, for brevity: “Data“) in order to make it simpler for you to request after-sales support in the event of defects, faults or damage to the Products and to publish reviews on the after-sales support received, and, where applicable, to make a complaint or to transfer possession thereof to third parties;
  • transmission of the Stored Data to other users of the Services in order to allow the transfer or sharing thereof; for example, in the case of giving the Products as a gift;
  • transmission of the stored Data to third Parties, such as manufacturing Companies or Technical Support Centres, Insurers, in order to make possible the activation and management of the Warranties or of the cover extensions, as well as repair work or other interventions on the products;
  • collection of reviews on the under-Warranty after-sales support you received, from the responsible Party, in order for them to be published on the Garanteasy website and to contribute to the automatic rating assigned to it; (hereinafter, for brevity: “Reviews“), ensuring compliance with the legislation in force (Italian Legislative Decree 26/2023) and with the dignity and integrity of the Parties subject to the reviews;
  • collection of information and Data regarding a warranty that has been denied to you in order to be able to assess the admissibility of a complaint to be forwarded to whoever denied such warranties and to facilitate the resolution of the case (hereinafter, for brevity: “Complaints“);
  • management of the Data and their transfer by virtue of the contractual relationships between Garanteasy and its Licensees in order to make it possible to provide you with the Services of interest to you.

Legal bases for the processing

We process your Data only where one of the legal bases set out in Article 6(1) of the GDPR applies. In particular:

  • Performance of a contract – Article 6(1)(b): the creation and management of your Account and Profiles, the digital storage of Proofs of Purchase, Technical Data Sheets, Points of Sale and Warranties, the activation and management of the Warranties and cover extensions, and the provision of the Services more generally, are necessary to perform the contract to which you are party or to take steps at your request prior to entering into it;
  • Compliance with a legal obligation – Article 6(1)(c): the retention of Data for the periods prescribed by law, including the duration of the legal guarantee, and compliance with applicable consumer-protection and record-keeping obligations;
  • Legitimate interests – Article 6(1)(f): the publication of Reviews and the automatic rating in order to inform consumers, the prevention of fraud and misuse of the Platform, the improvement of the Services, and the retention of Data for the limited additional period needed for the establishment, exercise or defence of legal claims. Where we rely on legitimate interests, we have assessed that those interests are not overridden by your interests or fundamental rights and freedoms, and you have the right to object to such processing (see “Your Rights” below);
  • Consent – Article 6(1)(a): processing that is genuinely optional, and the processing of any special-category data as described below, is carried out only on the basis of your freely given, specific and informed consent, which you may withdraw at any time.

Before giving any consent, we invite you to read your Rights and the Purposes of the Processing in the relevant paragraphs of this Policy.

Methods and duration of the processing

The processing will be carried out in automated and/or manual form with methods and tools, in compliance with the security measures for the processing itself, imposed by art. 32 GDPR. The processing will be carried out by internal and external Parties, bound by contractual or Licence relationships with Garanteasy, specifically appointed in accordance with the provisions of art. 29 of the GDPR. We point out that, in compliance with the principle of lawfulness, purpose limitation and Data minimisation, pursuant to art. 5 of the GDPR 2016/679, the period of processing of your personal Data is established as a time span no longer than that needed to achieve the purposes for which they are collected and processed and in compliance with the time limits prescribed by Law, that is, the period of validity of the legal guarantee and of any other warranty relating to the product you purchased, in addition to the period during which the product will remain on the market and spare parts will be available (up to 10 years), to which up to 5 years will be added for the establishment, exercise or defence of legal claims (our legal protection), and also to give you the time to associate any cover extension, or to register the transfer of the product to third parties and, finally, to manage repairs and its correct disposal. Your Data will be deleted within the 72 hours following the expiry of the last time limit among those mentioned above. In relation to the stated purposes, your Data will be subject to electronic processing. At your request, the data may remain stored for longer on the Platform for future uses such as, for example, requesting out-of-warranty repairs, transferring the product to third parties, or taking out cover extensions. We remind you that at any time and without giving reasons, you may request the deletion of all your data or part of it, as explained below, in the paragraph dealing with “withdrawal/deletion”.

Nature of the provision of the Data

The provision of certain Data is necessary in order to create an Account and to use the Services: it is a requirement necessary to enter into and perform the contract with you. Without such Data, Garanteasy is unable to create your Account, activate or manage your Warranties and cover extensions, or otherwise provide the Services. Where, instead, the processing is based on your consent (including any special-category data and any genuinely optional processing), the provision of the relevant Data is free and optional, and a refusal to provide it, or the withdrawal of a consent already given, will affect only the specific Service or feature that depends on it, without necessarily interrupting the other Services. The Platform on which your Data will be entered was designed by Garanteasy according to the criteria set out in art. 25 of the GDPR Reg. EU 679/2016, taking into account, already from the design stage, the most stringent requirements for the protection of your Privacy.

Source of the Data

Part of your Data is provided directly by you when you create your Account and Profiles and when you use the Services. In addition, as indicated in this Policy, some Data may not be collected from you directly but may be received from third parties – in particular from our Licensees and commercial partners (for example retailers, points of sale or manufacturers whose systems record a purchase), who may store your Data automatically on the Platform in connection with a purchase or a warranty. The categories of personal Data obtained in this way are the same as those described under “Purposes of the processing” above, namely identification and contact data, Proof-of-Purchase data, Product and Technical Data Sheet data, Point-of-Sale data and Warranty data.

Scope of communication and dissemination of the Data

Your Data may be communicated to:

  • all parties to whom the right of access to such Data is recognised by virtue of provisions of Law;
  • all parties whose right of access to the Data is recognised by virtue of a contract (for example a Licence agreement);
  • the collaborators and employees of Garanteasy, within the scope of their respective duties;
  • any third-party Companies or Associations appointed as Data Processors by Garanteasy and bound by a Data processing agreement;

We also inform you that the collected Data will never be disseminated and will not be subject to communication outside the Controller and the Processors, without an appropriate legal basis.

International transfers of the Data

As a rule, your Data are processed within the European Economic Area (EEA). Where the provision of a Service makes it necessary to transfer your Data to a recipient located in a country outside the EEA – for example a manufacturing Company, a Technical Support Centre or an Insurer established in a third country – such a transfer will take place only if the European Commission has recognised that country as providing an adequate level of protection (an adequacy decision under Article 45 of the GDPR) or, failing that, subject to appropriate safeguards under Article 46 of the GDPR, such as the European Commission’s Standard Contractual Clauses, together with any additional measures required to protect your Data. You may obtain information on the transfers carried out and a copy of the relevant safeguards by writing to privacy@garanteasy.com.

Controller and Data Protection Officer

In the event that you manually store the Data on the Platform, the Data Controller is Garanteasy. In the event that your Data were stored automatically by a Licensee, the role of Garanteasy within the processing of your Data may be that of processor, joint controller, or independent controller, depending on what is provided for by the Licence agreement entered into by Garanteasy with the Licensee Company of the Service. We remind you that you will be informed of these circumstances, at the time of acceptance of the Service by the Licensee itself, by means of a specific Policy. Garanteasy has not appointed a Data Protection Officer (DPO), as it is not required to do so under Article 37 of the GDPR; privacy matters are handled directly by the Controller’s privacy function. For any clarification and to exercise the Rights specified below (except for the withdrawal of consent to the processing and deletion of the Data, the procedure for which is indicated in the following paragraph “withdrawal/deletion”), you may freely contact the competent offices of Garanteasy by sending an e-mail to this address: privacy@garanteasy.com

Your Rights in relation to the processing

At any time you may exercise your rights, pursuant to art. 7 and arts. 15-22 of the GDPR Reg. EU 679/2016, with regard to the Controller and/or the Data Processors – The rights guaranteed by the aforementioned articles are:

  • to request confirmation of whether or not your Data exist on the Platform;
  • to obtain information about the purposes of the processing, the categories of your personal Data, the recipients, or the categories of recipients to whom your Data have been or will be communicated and the retention period;
  • to obtain the rectification and/or deletion of your Data;
  • to obtain the restriction of the processing of your Data;
  • to obtain the portability of the Data, that is, to receive them from the Data Controller or the Processor, in a structured, commonly used and machine-readable format, and to transmit them to another Controller of your Data without hindrance;
  • to object to the processing of your Data at any time where it is based on our legitimate interests, and in any case where it is carried out for direct marketing purposes;
  • to object to decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you;
  • where the processing is based on your consent, to withdraw that consent at any time. The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal;
  • to lodge a complaint with a supervisory authority. In Italy the lead supervisory authority is the “Garante per la protezione dei dati personali” (www.garanteprivacy.it); if you are in the EU/EEA, you may also lodge a complaint with the supervisory authority of the Member State of your habitual residence, place of work, or the place of the alleged infringement.

Automated processing and automatic rating

The “automatic rating” referred to in this Policy is a score calculated automatically from the Reviews in order to evaluate the after-sales support provided by brands, retailers and support centres. It is a rating of those businesses and of the support received, and not an assessment or profiling of you as a data subject. It does not produce legal effects concerning you, nor does it similarly significantly affect you, and it therefore does not constitute an automated individual decision within the meaning of Article 22 of the GDPR. Garanteasy does not take any decision producing legal or similarly significant effects on you that is based solely on automated processing.

Special-category (sensitive) Data

Garanteasy’s Services are designed to manage data about your purchases, Products and Warranties, and are not intended to collect special categories of personal data within the meaning of Article 9 of the GDPR (such as data revealing health, sexual orientation, or religious or philosophical beliefs). We do not request such data and we ask you not to upload it to the Platform. Where a Product you store may be associated with a personal circumstance (for example a medical device), Garanteasy treats the related information as ordinary Product and Warranty data: it does not infer, profile or otherwise process information about your health or any other special category. Should any special-category data nonetheless be provided by you, it will be processed only on the basis of your explicit consent pursuant to Article 9(2)(a) of the GDPR, kept with the utmost confidentiality, never disseminated or used to build a profile of you, and deleted on request as described in “Your Rights” above.

Cookies

The use of cookies and similar technologies on this website is described in detail in our separate Cookie Policy. You can set, manage and withdraw your consent to analytics and marketing cookies at any time through the cookie banner and through the “Manage cookies” link available in the footer of every page, which reopens the cookie preferences panel.

Withdrawal of consent to the processing of the Data for one or more Licensees and deletion of all the Data present on the Platform.

You may withdraw, at any time and without giving reasons, any consent you have given, as explained in the “Legal bases” and “Your Rights” paragraphs above; the withdrawal of a specific consent affects only the Service or feature that relies on that consent and does not, by itself, entail the deletion of your Account or the interruption of the other Services, and it does not affect the lawfulness of processing carried out before the withdrawal. Separately, you are granted the right to request Garanteasy to delete all your Data from the Platform by sending an e-mail to: privacy@garanteasy.com. Such a total deletion request will entail the deletion of all your Data from the Platform, including those of your user Account and related Profiles, even if such Data had been stored manually by you or related to automatic storage carried out by different licensees. The total deletion of your Data will therefore entail the complete interruption of all the Services. The deletion will take place within the 72 hours following the date of receipt of your deletion request, save where we are required or entitled to retain certain Data to comply with a legal obligation or for the establishment, exercise or defence of legal claims.

Effective date of this Document: 4 November 2026