1. Data Controller and Data Protection Officer
The Data Controller is Bending Spoons S.p.A., based in Corso Como 15, 20154 Milan, Italy, VAT, tax code and number of registration with the Milan Monza Brianza Lodi Company Register 08931860962, and REA number MI 2056926. For any requests regarding the processing of your personal data, please email us at email@example.com.
Our Data Protection Officer can be contacted for any requests relating to the processing of your personal data or this Policy by sending an email to firstname.lastname@example.org.
2. Purposes and Legal Bases
We process the following categories of personal data, for the purposes and on the legal bases indicated below. Please note that not all of the below information may be deemed personal data in your jurisdiction in all cases.
|Purpose||Legal basis||Categories of Processed Data|
|a. To enable you to use our website, to provide you with information about our products and services, and to process any requests you send to us when you contact us.||Processing is necessary to take steps at your request prior to entering into a contract (art. 6(1)(b) of the GDPR).||Identifiers and internet and network activity information, identification and contact information (such as email address), and information you provide us when you submit a request for information or when you contact our customer support.|
|b. To enable you to use the Remini web app and to provide you with its functionalities, including editing or enhancing your images and videos, and creating an account and authenticate your access to your account.
You are also free to decide to help us to improve our apps by becoming part of our app development program, and uploading media with specific features we request.
|Processing is necessary for the performance of our contractual relationship (art. 6(1)(b) of the GDPR).||Identification and contact information, identifiers and Internet and network activity information (such as IP address, information about your interactions with the web app, and unique identifiers), payment information (such as payment provider, duration of subscription, price), and other information necessary to enable you to use the web app.
If you create an account or login with your Facebook, Google or Apple account, we will also receive the following information: first and last name, and email address.
The website processes the images, videos and audio recordings that you upload, including images containing faces, as well as the enhanced photos generated by the website. When images contain faces, we process certain information about them, such as information that estimates the location of parts and areas of the faces ("Facial Data"). Note that in some jurisdictions outside of Europe, Facial Data may be considered biometric data. The photo-video editing and enhancing technologies implemented in the website do not allow unique identification or authentication of people in the images, nor are we training the technologies to do so. This means that we only use the website to enhance the images containing faces shared by the user.
|c. To carry out statistical analysis, and to improve our products and services (for example, by conducting statistical analysis or other research activities to optimize our features and provide you with new ones).||The legal basis for the processing is our legitimate interest (art. 6(1)(f) of the GDPR) to improve our products and services.
Moreover, processing of anonymized data is not subject to a legal basis.
|Identification and contact information you provide us (such as name or email address, when requested), identifiers and Internet and network activity information (such as IP address), information collected or generated to improve the web app’s functionalities (such as information about your interactions with the web app, inferences we generate and other related information about your usage of the web app), and anonymous information that cannot be used to identify you.|
|d. To improve our photo-video editing features in Remini and in other photo-video editing apps provided by us and our subsidiary companies, and offer a better service for editing and enhancing your images (for example, by using your videos and images to train and validate our photo-video editor algorithms in Remini and in other similar mobile and web apps provided by us and our subsidiary companies, and by examining and labelling your images to improve the performance of our editing and enhancement features).||The legal basis for the processing is your consent (art. 6(1)(a) of the GDPR).||If you have an account and upon your consent, we will receive images, videos and audio-recordings uploaded by you.
We do not collect or use Facial Data of US based users to improve our photo-video editing and enhancing features nor to train our photo-video editor algorithms.
|e. To carry out marketing activities and send you information and marketing communications about our products and services such as tips, offers, and newsletters through emails.||The legal basis for the processing is your consent (art. 6(1)(a) of the GDPR).
Where your consent is not required, for example, where we use your email to send you information about products and services related to or similar to the app (“Soft Opt-In”), the legal basis is our legitimate interest (art. 6(1)(f) of the GDPR).
|Identification and contact information (such as name, email address), identifiers and Internet and network activity information (such as IP address), information we may receive from third-party advertising networks and platforms (such as unique identifiers), information about your interactions with the web app, inferences we generate and other related information about your usage of the app (such as your responses and your voice in case you take part in our interviews).|
|f. To comply with our legal obligations, including requests from public authorities.||Compliance with a legal obligation to which we are subject (art. 6(1)(c) of the GDPR), and our legitimate interest (art. 6(1)(f) of the GDPR) to carry out processing activities for this purpose.||Any information which may be required by law or under the instructions of public authorities. To comply with tax legislation, we may process personal data necessary to determine your location, such as billing address, IP address, location of the bank account used for a payment or billing address of the customer held by that bank.|
|g. To process and respond to customer support communications and to requests for information you may raise with us.||The legal basis for the processing is the performance of our contractual relationship (art. 6(1)(b) of the GDPR).||Identification and contact information you provide us (such as first and last name, email address) and the content of your communication or request.|
|h. To analyze your usage information, including your preferences, interests and behaviors when you use our products and services, to:
||The legal basis for the processing is our legitimate interest (art. 6(1)(f) of GDPR).||Identification and contact information (such as name, age or email address, when requested), identifiers and Internet and network activity information that we collect (such as IP address), information about your interactions with the app, inferences we generate and other related information about your usage of the web app.|
|i. To establish, exercise or defend our rights and those of our employees, and to carry out corporate transactions or operations (for example, in case of bankruptcy, merger, acquisition, reorganization, sale of assets or assignments, and due diligence related to any such transactions).||Our legitimate interest (art. 6(1)(f) of the GDPR).||Any information necessary to ensure the performance of these purposes.|
3. Data Retention
Personal data may be processed by both automated and non-automated means and may be stored at our premises and on our service providers’ servers. We adopt technical and organizational measures designed to prevent the loss, improper use and alteration of your personal data. In some cases, we may also adopt data encryption and pseudonymization measures. However, transmissions over the Internet are never 100% secure, and you should not provide any personal data if you want to avoid any risk.
Personal data processed for the purposes referred to in section 2.a), 2.b), 2.f), and 2.g) will be kept for a period not exceeding the one necessary for the said purposes and, in each case, for no more than 10 years from the termination of the agreement. Images, videos and audio-recordings uploaded to the web app are deleted from our servers after 15 days.
Personal data processed for the purposes referred to in section 2.d) will be kept for no more than 3 years from the upload of the images, videos and audio-recordings.
Personal data processed for the purposes referred to in section 2.c), 2.e) (regarding the “Soft Opt-In”), 2.h) and 2.i) will be kept until you object to such processing. However, should you not exercise your right to object, personal data will be kept for such purposes for no more than 2 years from the termination of the agreement.
Personal data processed for the purposes referred to in section 2.e), will be kept until you withdraw your consent to such processing. However, should you not withdraw your consent, such personal data will be kept for no more than 2 years from the termination of the agreement.
Except for any legal obligation that sets a longer data retention period, at the end of these periods, the personal data processed will be deleted or anonymized.
To know how long your data is stored through cookies, see section 11 (Cookies) below.
4. Your Choices
Providing navigation data is necessary if you want to navigate and interact with our website. It is also necessary for you to provide your personal data for the purposes referred to in sections 2.a), 2.b), 2.f), and 2.g). If you do not provide such personal data, you will not be able to enjoy the website or web app’s services and features.
Where we rely on your consent for the purposes referred to in sections 2.e), your provision of personal data is optional, and you have the right to withdraw your consent at any time. If you do not provide the personal data, you will still be able to enjoy the app’s services and features. Where we rely on our legitimate interest for the purpose referred to in sections 2.c), 2.e), 2.h), and 2.i), you may, at any time, exercise your right to object to such processing as explained in section 7 (Your Rights) below.
You can freely decide whether to accept cookies and other tracking technologies not strictly necessary for the functioning of the website as indicated below in section 11 (Cookies) below.
5. Sharing Your Personal Data
We may share or disclose your personal data to the following categories of recipients:
- Vendors carrying out activities that are related or instrumental to our business and operational activities as outsourced data processors appointed in writing in accordance with Applicable Privacy Laws, or acting as autonomous data controllers (such as IT or storage service providers, mobile measurement partners, suppliers of mobile marketing services).
- If we carry out a corporate transaction or operation (for example, in case of bankruptcy, merger, acquisition, reorganization, sale of assets or assignments, and due diligence related to any such transactions), your personal data may be disclosed to our advisers and any prospective purchaser's advisers, and may be one of the assets that is transferred to another owner.
- Public, judicial or police authorities, within the limits set by applicable laws.
Your data can also be collected by third parties when you accept third party cookies. Please see section 11 (Cookies) below for more information.
Personal data will not be disclosed for any reason other than those stated above, unless such disclosure is deemed necessary for the fulfillment of a legal obligation or if we request your consent.
6. Transfers of Personal Data Outside the European Economic Area
We may transfer personal data from the European Economic Area (“EEA”), the UK or Switzerland to other countries outside the EEA. Such data transfers are based on appropriate safeguards in accordance with Applicable Privacy Laws, including (a) the standard contractual clauses developed by the European Commission; (b) the decisions of adequacy of the European Commission; or (c) binding corporate rules.
More information on the appropriate warranties is available for consultation by sending an email to email@example.com.
7. Your Rights
At any time and free of charge, you can exercise the following rights, as specified and subject to certain limitations and exceptions under Applicable Privacy Laws.
As to the limitations to the exercise of your rights, if you have not created an account or you are not authenticated prior to using the app, your personal data (such as images, videos and audio-recordings) will be deleted after 14 days since their upload according to the data minimization and storage limitation principles. Therefore, after 14 days, it might not be possible to follow up on your request to exercise your privacy rights.
Your privacy rights are namely:
- Right of access. You have the right to obtain information about the processing of your personal data and to access it.
- Right to rectification. You have the right to ask for the updating, rectification or integration of your personal data.
- Right to erasure. You have the right to request the deletion of your personal data.
- Right to restriction of processing. You have the right to request the restriction of the processing of your personal data.
- Right to data portability. You have the right to obtain a portable electronic copy of your personal data.
- Right to object. Where we rely on our legitimate interest to process your personal data, you have the right to object to such processing, wholly or partly, on grounds related to your particular situation. In particular, you are entitled to object to the processing of your personal data for direct marketing purposes, including profiling.
- Right to withdraw your consent. Where we rely on your consent to process your personal data, you have the right to withdraw your consent, although the processing carried out before your withdrawal of consent will remain valid.
You also have the right to lodge a complaint before the competent national Data Protection Authority, in particular before the Data Protection Authority of the Member State of your habitual residence, place of work or place of the alleged infringement.
To exercise your rights, or if you have any other questions about privacy or data protection at Bending Spoons, you can contact us by sending an email to firstname.lastname@example.org. We may take reasonable steps to verify your identity prior to responding to your request.
8. Children's Personal Data
The web app is not intended for anyone under the age of 16. We do not knowingly collect personal data from children. If you believe we have received personal data from children under the age of 16, please email us at email@example.com. If we learn that a user is under the age of 16, we will take reasonable steps to delete any processed data and close such user’s account.
9. Third-Party Websites and Services
The website or web app may include links to other websites or services operated by third parties. The activities described in this Policy do not apply to data processed by such third-party websites and services. We have no control over, and we are not responsible for, the actions and privacy policies of third parties and other websites and services.
10. Additional information for Users in Illinois
In accordance with Illinois law, this section provides additional disclosures related to Facial Data. As described in Section 2, we collect and process Facial Data to enhance your photos. We do not collect or use Facial Data to improve our photo-video editing and enhancing features nor to train our photo-video editor algorithms. We retain personal data as described in Section 3 (Data Retention). We use cloud storage providers to store Facial Data. We will never sell, lease, or trade Facial Data to third parties. As described above, Facial Data may be considered biometric data in some jurisdictions; however, Facial Data is not used for identification or authentication purposes.
What are cookies and tracking technologies?
When we use the word “cookies” in this Policy, we mean any tracking technology that stores or accesses information on the user’s device, including any SDK, tracking pixel, HTML5 local storage, local shared object, and fingerprinting technique.
Cookies are usually classified: (A) by purpose (Technical cookies, Analytics cookies, Profiling cookies); (B) by publisher (First-party cookies, Third-party cookies); and (C) by duration (Session cookies, Permanent cookies).
This classification is important because different legal requirements apply based on how the cookie is classified.
Below you will find the types of cookies and tracking technologies as classified with some practical examples.
A. By purpose
Technical cookies are used solely for the purpose of transmitting messages over an electronic communication network, or to provide a service specifically requested by the user.
In other words, technical cookies are essential for the correct functioning of the website and to provide the service offered to and requested by the user.
For example, technical cookies can be used to monitor sessions, to store specific server access information related to the user configuration, to facilitate the use of online content, or to keep track of items in a shopping cart or information used to fill in a form.
Technical cookies include the functional cookies you might find mentioned while browsing the Website.
Technical cookies do not need your consent.
Analytics cookies may be used to assess the effectiveness of an information society service provided by a publisher, to evaluate and improve the design of a website or to help measure its traffic.
In other words, analytics cookies may be used to track the traffic and performance of a website, by collecting aggregate data on the number of visitors and how they interact with the website to improve its services.
For example, analytics cookies may collect information about how users access a website, including the number of visitors, possibly grouped by geographical area, time slot, how long visitors stay on the site for, what parts of the site they visit or other characteristics, the number of pages visited or the number of users who viewed a particular section.
Please consider that if analytics cookies are properly anonymized, they can be installed without your previous explicit consent.
Profiling cookies may be used to trace specific actions or recurring behavioral patterns in the use of the offered functionalities back to specific, identified or identifiable individuals for the purpose of grouping the different profiles within homogeneous, multi-sized clusters. This is aimed in turn to enable a company to provide increasingly customized services beyond what is strictly necessary for the delivery of the service and also send targeted advertising messages in line with the preferences expressed by the user during their web-browsing activities.
In other words, profiling cookies may be used to convey behavioral advertising, measure the effectiveness of ads, or to customize the services offered in line with the user’s monitored behavior.
For example, profiling cookies can be used to create user profiles and offer content in line with the user’s interests, or to send targeted ads or messages.
Profiling cookies include the performance, marketing and social media cookies you might find mentioned while browsing the Website.
Profiling cookies need your explicit consent.
B. By publisher
Cookies are installed directly by the website that the user is browsing. In other words, the publisher of the website installs the cookies directly without using any third-party publishers and processes the information thereby acquired.
Third-party cookies are set by external providers other than those of the website that the user is browsing. In other words, the publisher of the website installs the cookies indirectly, using third-party publishers and processes the information thereby acquired.
The data collected by these third parties is governed by their own specific privacy policies, terms and conditions, or cookie policies to which we have no control over.
When our website hosts third-party non-anonymized analytics cookies and/or profiling cookies, you will be asked to consent to such third-party cookies when landing on our websites for the first time, via a specific cookie banner.
You can manage and delete these third-party cookies at any time by accessing the privacy policies of the third parties as indicated in the following section ("Types of cookies used by the Website”).
C. By duration
Session cookies expire when the user's browsing session expires.
Permanent cookies last longer than a single browsing session.
Types of cookies used by the Website
This Website installs the following types of cookies. You can customize your cookie preferences at any time by accessing the cookie management platform on our website.
You can also disable (in whole or in part) technical cookies through the specific functions of your browser. Please note, however, that if you don’t allow technical cookies, you may not be able to use the Website, view its contents and take advantage of its services. Inhibiting technical cookies may result in some services or features of the Website not being available or not working properly and you may be required to modify or manually enter certain information or preferences each time you visit the Website.
The choices you make with respect to the Website's cookies will be recorded in a cookie. However, in some circumstances this cookie may not work properly: in such cases, we recommend that you delete the cookies you do not like and inhibit their use through the features of your browser.
Your cookie preferences will need to be reset if you use different devices or browsers to access the Website.
You can find information on how to manage cookie settings on certain browsers via the following links:
For more information about how to limit the use of third-party cookies installed in your browser, please visit www.youronlinechoices.com. Once arrived on the website, by accessing the "Your ad choices" section, you will be able to view the list of third parties that install cookies on your browser and manage your consent granularly ("On/Off"). Moreover, by expanding the "Info" section, you will be able to access to more information about each third party and its privacy and cookie policies.
With regards to your rights under applicable Data Protection Laws, please refer to Section 7 above.
We may modify, integrate or update, in whole or in part, this Policy, and we will notify users of any modification, integration or update in accordance with Applicable Privacy Laws. If we make modifications, we will notify you by revising the date at the bottom of this Policy and, under certain circumstances, we may also notify you by additional means such as pop-up or push notifications within the web app or our website, or email.
Last updated: 8 August 2023