EU, Swiss and UK Privacy Policy

[published on December 6, 20234]

This policy sets out the basis for the processing of personal data we collect from you, or that you provide to us. Please read the following carefully to understand our views and practices regarding your personal data and how we will process it. It is important that the personal data we hold about you is accurate and up to date. Please let us know if your personal information (for example, your name or address) changes during your relationship with us, so that we can update our records.

This privacy policy explains:

  • Who we are;
  • Your rights;
  • What personal information we collect;
  • How we use your personal data;
  • Who we share your information with and why;
  • How we keep your information safe;
  • How long we retain your data; and
  • How to contact us.

In this document, “We”, “Us” and “Our” refers to Blupura S.r.l., with registered office in Italy, Recanati – ZISquartabue – (MC), Via Atlantico Volponi 11, VAT number 02362310423 (also “Data Controller”).

  1. 1. About us

For the purposes of the legislation on the protection of personal data, the Data Controller is part of the Culligan International Group ( “Culligan“), a world leader in providing cleaner, softer water through innovative, sustainable solutions and unmatched service across all industries.

With more than 13,000 team members and 1,000 retailers in 90 countries, Culligan’s more than 35 brands serve more than 50 million customers each year and share a mission to bring better water to consumers wherever they need it – at home, at work or on the go.

This Privacy Policy has been drafted, for the purposes of uniformity, taking into account the main processing activities performed by the companies of the Culligan Group, without prejudice to the possibility, for each company of the Group, to integrate this Policy in order to take into account its own organisational needs.

If you are a resident of the EU, the European General Data Protection Regulation (the “GDPR”) applies to this Policy. GDPR“), as well as, if applicable, the applicable local law that has implemented or adopted the GDPR.

We have also entered into an intra-group agreement containing the Standard Contractual Clauses approved by the European Commission to ensure that all transfers of personal data to any Culligan entity are protected to the same level as required by European data protection law.

2. Your rights

You have the right to:

  • Ask us if and how we are processing your personal data and for what purpose;
  • Obtain a copy of the personal information we hold about you (right of access);
  • Update or correct your personal data (right to correction);
  • Request the deletion of your personal data; and
  • Request, under certain conditions, limiting of the processing of your personal data (right to limit processing).

Additionally, in certain circumstances you have the right to:

  • object to the processing of your personal data (right to object);
  • object to automated decision-making and profiling (the right not to be subjected to automated decision-making, including profiling); and
  • request that information about you be provided to third parties in a commonly used, machine-readable form (right to data portability).

Exercising your rights

For information about your rights, including how to correct, restrict, delete and modify your personal data or if you would like to request a copy of the personal data we hold about you, you can contact us by clicking here.

Costs

Access to your personal information (or exercising any of the other rights) will not, as a rule, involve any charge to you.

In some cases, we may charge a reasonable fee if your request for access is manifestly unfounded or excessive, or if you request multiple copies of the information. Alternatively, where such circumstances apply, we may refuse to comply with the request.

What we require from you

We may need to request specific information from the data subject to help us confirm their identity and to ensure their right to access the information (or to exercise any of their other rights).This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

If you are not satisfied with our response or if you require further information about your data protection rights, you can visit the institutional website of the local Data Protection Authority (also “DPA”).

  1. 3. What personal information we collect

“Personal data” means any information relating to an individual that allows that individual to be identified, directly or indirectly. This information includes personal data such as your first and last name, e-mail address and telephone number, job title, department, preferences and our communications with you.

Information provided by the user

We will collect your personal data if:

  • you fill out a contact form on our website;
  • you contact us for information or assistance on our products and services;
  • you sign a contract with us;
  • you sign up for a free trial;
  • you access our portal and/or any of our applications;
  • you participate in a survey;
  • you request to download e-books, guides, product data sheets or other resources on our website;
  • you participate in commercial or promotional events;
  • you interact with us through our social media channels;
  • you consent to receiving marketing communications from us; and/or
  • you apply for a job offer.

This information may include personal data, such as your full name, e-mail address, and telephone number.

Information we collect about you

The type of personal information we collect depends on the purpose for which it is collected and may include:

  • Information about you to identify you and manage your relationship with Blupura (for example, name, address, e-mail, postcode, telephone number(s);
  • Information about your contractual relationship with us (e.g. customer code, order history, etc.);
  • Copy of documentation (e.g. bank statements, letters, invoices, correspondence);
  • Economic and financial information (e.g. payment card numbers, bank details, payment history; on behalf of financial institutions we also collect certain data relating to the purchase of devices financed by a loan (e.g. pay slips, proof of address etc.);
  • Audio and visual information, in case you visit one of our locations where a video surveillance system (for example, closed-circuit television) is installed;
  • Marketing/communications data (for example, information relating to marketing and external communications, such as marketing campaigns, opt-in information and preferences); where we have used consent as a lawful basis for contacting you, this can be withdrawn at any time;
  • Lifestyle information (e.g. water consumption volume, mineral/vitamin supplements, Information required to select the correct appliance for your home, such as the number of people living in the home in question, tap water consumption, electricity consumption);
  • Information about your visit to the website, the Internet Protocol (IP) address used to connect your computer to the Internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform, including the full Uniform Resource Locators (URL) clickstream to, through and from our website (including date and time); the products you viewed or searched for; page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), methods used to browse away from the page and any phone number used to call our customer service;
  • Information on employment and education (e.g. employer data, relevant professional qualifications, etc.)

We may also collect information about you from other sources, such as:

  • other Culligan Group companies;
  • external third parties (for example, credit reference agencies to verify your identity and financial standing, event coordinators if you are present at a stand); and
  • from cookies (cookies are small text files that are placed on your computer by the websites you visit. They are widely used to make websites work, or work more efficiently, as well as to provide information to the owners of the website).
  1. 4. How we use your personal data

We will only use your personal data when the law allows us to do so and for the purposes set out in this policy. These are:

  • When consent is given;
  • When it is necessary for the performance of a contract we have entered into or are entering into with the data subject;
  • If necessary to comply with a legal or regulatory obligation;
  • For our legitimate interests or for those of a third party, provided that your interests and fundamental rights and freedoms do not override those interests.

We may use your personal data to provide and administer the services you request and/or to respond to your queries. If you do not provide us with certain information, we may not be able to process your request.

We may also use your personal data to comply with our legal obligations, to handle any complaints and to enforce our terms and conditions.

We may use your personal data for our legitimate business interests, which include security purposes, improvements to our website, improvements to our solutions and services, and for general marketing and internal tracking and reporting purposes. However, we will not do so if our interests outweigh your interests, rights and freedoms.

We process your information for the following purposes

Below we have provided a description of how we intend to use your personal data in compliance with the principles of lawfulness provided for by the legislation.

(A) To perform our contract with you and to support and maintain that relationship. This includes the following:

  • to register you as a potential or new customer;
  • to process and deliver your order, including managing payments, fees and charges and collecting and recovering any amounts owed to us;
  • as part of our personnel search and selection activities.

The provision of your personal data, indicated in points (i), (ii) and (iii) is optional, but any failure to provide them could make it impossible to perform the requested services. In such cases, consent to the processing of personal data will not be requested as such processing falls within the provisions of article 6, para.1, letter b) of the Regulation, without prejudice to the provisions of art. 111 bis of Italian Legislative Decree.196/2003 regarding the purpose referred to in point (iii).

(B) To comply with the legal and regulatory requirements. These requirements include the following:

  • to confirm your identity for regulatory purposes;
  • to detect and prevent fraud;
  • to comply with our data protection obligations.

For the purposes referred to in points (iv), (v) and (vi), the processing of your personal data is performed pursuant to art. 6, para.1, letter c) of the Regulation.

(C) For specific business purposes, in order to provide you with appropriate products and services and a safe experience. Our business purposes include the following:

  • to manage our relationship with you, including notifying you of changes to our terms or privacy policy and/or asking you to leave a review or to participate in a survey;
  • to send you commercial communications via e-mail regarding products and services similar to those you purchased, unless you expressly refuse to receive such communications (“Soft Spam”);
  • to send you newsletters, to keep you updated on new products or services or to recommend other goods or services that may interest you, to inform you of special offers and to invite you to our events;
  • to provide you with relevant website content and advertising and to measure or understand the effectiveness of such advertising;
  • to use data analytics to improve and develop our website, products/services, marketing, customer relationships and experiences;
  • to operate and protect our business and website (including troubleshooting, data analysis, testing, system maintenance, support, reporting, and data hosting).

The processing of your personal data for the purpose referred to in point (viii) constitutes legitimate processing pursuant to the applicable legislation in force regarding the protection of personal data, which does not require your consent. You may object to the processing for this purpose at the time of purchase or in subsequent communications to the purchase of products and services by the Data Controller by writing to the addresses indicated in this information notice, as well as using the link found at the bottom of each communication sent via e-mail.

For the purposes referred to in points (vii), (ix) and (x), the processing of your personal data is performed pursuant to art. 6, para.1, letter a) of the Regulation.

For the purposes referred to in points (xi) and (xii), the processing of your personal data is performed pursuant to art. 6, para.1, letter f) of the Regulation.

We may also process your personal data in order to comply with a legal obligation to which we are subject or, finally, to pursue a legitimate interest of ours or of third parties, including any defensive purposes, in compliance with the conditions and constraints set forth by the legislation in force.

In the near future, we may also use AI technologies and data from the Internet of Things “IoT”, including machine learning, to perform certain tasks. In this case, the result will be subject to human control and review and we will not include your personal data in any data analysis with a third-party model without informing you. Where we use publicly available templates for general marketing purposes, we will give you the option to be anonymised or omitted from the data provided. We will always seek to use AI technologies in line with the legislation, regulatory guidance and government policies.

Change of intended use

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. We may also process your personal data in connection with an acquisition or sale. In this case, we will inform you of any changes to the processing or data controller resulting from this activity.

You have the right to object to the processing of your personal data for some of the marketing purposes listed above but, if you do so, this may impact on our ability to provide you with some or all of our services. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

5. How we keep your information safe

We are committed to ensuring the confidentiality of the personal information we hold and continually review our security controls and related policies and procedures to ensure the safety of your personal information.

When we contract with third parties, we impose security, privacy and confidentiality obligations on them to ensure that personal information is kept safe and protected from unauthorised or accidental access, processing, copying, modification, deletion, loss or use.

If we work with third parties in countries outside the UK or the European Union, we ensure that they are countries that the UK Government and the European Commission have confirmed as having an adequate level of protection for personal data, or that the organisation receiving the personal data has provided appropriate safeguards and agrees to process your data with the same level of protection as we would.

We also use the UK’s international data transfer agreements and the EU’s standard contractual clauses for transfers outside the UK or the European Economic Area.

In limited circumstances, data may be accessed by employees outside of our usual operating locations. In such circumstances, we ensure that appropriate security measures are in place to safeguard your information.

  1. 6. Who we share your information with and why

We will not sell your personal data and generally will not provide it to third parties, but there are some exceptions. We may share your personal data in the following ways (as appropriate):

  • Culligan Group companies:
    • for administrative, analytical and statistical purposes;
    • to test the IT systems managed by our companies;
    • to produce a consolidated view of our relationship with you in order to improve the services we can offer you;
    • to send you marketing communications that you have agreed to receive, or which we think may be of interest to you based on the services you receive from us or other companies in our group;
    • to provide service messages relevant to our relationship with you;
    • to handle complaints and to fulfil data subject rights (such as the right of access).
  • Companies appointed by Blupura (these third parties may be based in countries outside the United Kingdom or the European Union):
    • with third parties or service providers who provide additional data about you in order to improve our ability to design and develop new products and services that can be marketed and sold to meet the needs of the consumer groups we have identified and are targeted accordingly;
    • with debt collection agencies for debt research and recovery;
    • with payment service providers to enable the completion of payments;
    • with our accountants for the production of tax returns and to support legal reporting;
    • with our legal advisors or auditors;
    • with information technology and cybersecurity providers;
    • with third parties or service providers to conduct market research on our behalf, to help us improve and develop the products and services we provide to you and to other customers;
    • with a prospective buyer (or its advisers), for due diligence purposes, if we are considering a sale of all or part of our business. For example, in the event of a merger, acquisition, sale, change of control or liquidation of Blupura or part of its business (or in anticipation of such event), we may share your personal data as part of such extraordinary transaction, where necessary to fulfill the obligations set out in this Policy.
  • Organisations and individuals appointed or authorised by you;
  • Public authorities:
    • for the purposes of preventing or detecting crime and/or other offences, we may share the personal data collected by us with law enforcement agencies, other public or private sector agencies, government bodies or representatives, in accordance with the applicable legislation, in order to comply with any legal obligation or as otherwise permitted by law. This includes public authorities, insurance companies, financial companies and/or other agencies.
  1. 7. Data retention

We will only retain your personal data for as long as it is necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements. In case the processing is based on your consent, we will process your personal data only until your consent is revoked.

To determine the appropriate retention period for personal data, we consider the amount, nature, and quality of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

The personal data processed for the purposes referred to in points (i) and (ii), falling within the scope of article 6, para.1, letter b) of the Regulation, will be stored for:

(a) the period of 10 (ten) years starting from termination of the contract; or, in the event that the data subject does not conclude a contract with the Data Controller following the establishment of a pre-contractual negotiation, for

(b) the period of 24 (twenty-four) months from the start of the negotiation.

For the purpose referred to in point (iii), your personal data will be retained for a period of 24 (twenty-four) months starting from transmission of the curriculum vitae, without prejudice to the longer retention obligations provided for in the event of the establishment of a subordinate or independent employment relationship, of coordinated and continuous collaboration, of an agency mandate and/or the possible granting of a sales assignment or of a commercial relationship.

The personal data processed for the purposes referred to in points (iv), (v) and (vi), falling within the scope of article 6, para.1, letter c) of the Regulation, will be retained for the period established by the applicable legal provisions.

For the purpose referred to in point (viii), your personal data will be retained until you object to the processing by writing to the contact details in article 1 of this information notice or through the link found at the bottom of each e-mail sent.

For the purposes referred to in points (vii), (ix) and (x) your personal data will be processed, as a general rule and without prejudice to the principle of data retention proportionate to the purpose of the processing, until your consent is revoked. In the event that you withdraw from a pre-contractual negotiation without having revoked such consent, the data may also be processed after your withdrawal.

For the purposes referred to in points (xi) and (xii), your personal data will be processed for the period strictly necessary to achieve the legitimate interest of the Data Controller.

We will take all reasonable steps to ensure that your personal data is treated securely and in accordance with this policy.

  1. 8. How to contact us

If you have any questions about this policy, or if you require further information about our privacy practices, or if you wish to raise a complaint about how we have handled your personal data, you may contact the Data Controller by clicking here.