Privacy notice on the processing of personal data – Complaint handling

(Art. 13, Regulation EU 2016/679 – GDPR)

This privacy notice is provided by Coind sc to illustrate the purposes and modalities of processing personal data collected through the "Reclami" form or submitted directly to the competent offices to report service failures or product nonconformities.

1. Data Controller

The Data Controller is Coind sc, with registered office at Via Saliceto 22/H - 40013 Castel Maggiore (BO). For communications concerning complaint management and the exercise of privacy rights relating to this specific processing, the data subject may write to: customercare@coind.it.

2. Categories of Personal Data Processed

For correct handling of the complaint, the Controller processes:

  • Identification and contact data: name, surname, physical address, email address, telephone contact.
  • Product/service data: purchase references, receipt or invoice, product lot code, date of detection of the defect, photographic documentation of any nonconformity.
  • Content of the complaint: detailed description of the event subject to the complaint and any other information the data subject deems appropriate to insert (including data communicated during service use).
  • Data relating to litigation: in case of formal proceedings, data concerning legal strategy, conciliation minutes or court documents may be processed.

3. Purposes and Legal Basis of the Processing

Data will be processed for the following purposes:

  1. Complaint management and customer care: reception, analysis and response to the data subject’s report, including internal quality verification procedures and lot traceability.
    • Legal basis: performance of contractual or precontractual measures (Art. 6(1)(b) GDPR) aimed at proper execution of the supply relationship.
  1. Management of disputes and legal protection: protection of the Controller’s rights in outofcourt (mediations, conciliations) or judicial proceedings arising from the complaint.
    • Legal basis: legitimate interest of the Controller in defending its rights and interests (Art. 6(1)(f) GDPR).
  1. Compliance with legal obligations: fiscal, administrative obligations or obligations deriving from product safety and food traceability regulations.
    • Legal basis: legal obligation (Art. 6(1)(c) GDPR).

4. Nature of Provision

Provision of data indicated as mandatory is necessary to process the complaint. Refusal to provide such data will make it impossible for the Controller to handle the report, verify the veracity of the claims and provide a comprehensive response.

5. Recipients of the Data

Personal data may be communicated to:

  • Authorised internal staff (Quality Office, Customer Service, Legal Office, Administration);
  • External parties appointed as Data Processors (Art. 28 GDPR) such as IT service providers or CRM platform providers;
  • Legal consultants, expert witnesses, the Controller’s insurance companies for management of claims and liabilities;
  • Mediation bodies, courts or law enforcement authorities, where required by law or for the protection of rights.

6. Retention Period

In accordance with the principle of proportionality, data relating to complaints and dispute management will be retained for 10 years from the date of definitive closure of the file or from the resolution of the dispute. This period corresponds to the ordinary prescription term provided by the Civil Code for contractual liability, thereby enabling the Controller to evidence the correctness of its conduct in case of belated legal actions.

7. Data Subject Rights

The data subject may exercise the rights provided by the GDPR (Arts. 15–22), including:

  1. Access to their data and to information about the processing;
  2. Rectification of inaccurate data or completion of incomplete data;
  3. Erasure of data (subject to legal retention obligations or the Controller’s right to defence);
  4. Restriction of processing or objection to processing for legitimate reasons.

Requests should be addressed to: customercare@coind.it. If the data subject believes that processing violates applicable laws, they may lodge a complaint with the Data Protection Authority.