(pursuant to EU Regulation 2016/679, “Regulation”)

Menabòh Srl (hereinafter “Menabòh”), with its registered office in Montevachi (AR), Via della Resistenza 6, 52025, is the Data Controller of your personal data collected through this website www.menaboh.com (“Site”) and the social media pages used by Menabòh (hereinafter “Social Pages”). Please note that Menabòh will process your data in compliance with the current regulations and as described below.

This privacy notice describes the methods by which personal data of users accessing the Site—whether registered or not—and who use the services offered by the Site, including account registration and online purchase of products and services, are processed.

Thus, the personal data of the user are processed by Menabòh in accordance with current legislation and as described below.

1. Categories of Personal Data Collected and Processed

Menabòh collects and processes the following data from those who access and visit the Site and/or the Social Pages:

1.1 Personal Data Collected Automatically

• Browsing Data: The IT systems and software procedures responsible for the functioning of this Site acquire, during their normal operation – also through the use of technical cookies – some personal data whose transmission is implicit in the use of Internet communication protocols. These are pieces of information that are not collected to be associated with identified data subjects, but which by their very nature could, through processing and association with data held by third parties, allow users to be identified. This category includes IP addresses or domain names of computers used by users connecting to the Site, the URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numeric code indicating the status of the server’s response (success, error, etc.), and other parameters related to the user’s operating system and IT environment.
• Aggregated Information on User Behavior on the Site: (for example, clicks and/or mouse movements) collected through the use of cookies; for more information on Menabòh’s use of cookies, please refer to the relevant cookie notice.

1.2 Personal Data Provided Directly by You

• Personal Identification Data (for example: first name, last name); contact details (such as email address, physical address, telephone number, and mobile number); account name and password; payment data; shipping and billing addresses; purchase data (date, quantity and type, product code, sales amount, VAT number where applicable, information on complaints, returns, warranties, and refunds, and other information related to the sale of products and services on the Site), provided during Site registration or while using certain services, such as the online purchase of products and services. Although registration on the Site allows you a simpler browsing and purchasing experience, online purchases can also be made without registration.
• Personal data provided when filling out forms or modules on our website (for example, to request the loyalty card, respond to a job posting, or when accessing and using the area reserved for loyalty card holders – for this purpose, please review the notices that Menabòh publishes at the bottom of the forms or attached to the Card usage regulation – which contain more detailed information on the processing of personal data in that context).
• Any contacts with Menabòh via customer service or the optional and spontaneous sending of messages, via email or traditional mail, to the addresses provided on the Site lead to the subsequent acquisition of the sender’s address, including the email address or telephone number needed to respond to the inquiry, as well as any other personal data included in the communication.

• Data regarding your purchasing habits and preferences.
• Any data of third parties (for example, recipients of products sent as gifts) which, although not using the functionalities and services of the Site, may nonetheless be collected by Menabòh as they are entered by the user as delivery recipients. In the case of data provided by third parties, you must ensure that you have expressly obtained their prior consent and agree to transfer to Menabòh the information contained in this notice.

You are responsible for ensuring that the personal data provided to Menabòh are correct and, in case of changes, for updating such data by writing to Menabòh or using the options allowed within your personal area if you are registered.

1.3 Personal Data Collected Through Social Media Pages Used by Menabòh

Menabòh may also collect some of your personal data when interacting with the Social Pages. Some information is communicated directly to Menabòh by you when you decide to share – through your profile – images posted on our Social Pages, comment on our posts and/or express your liking for one of our products, initiatives, or events by selecting the appropriate buttons, as well as when you decide to send us an email via the private chat or other channels provided on the various social media platforms.

We may also become aware of some information indirectly collected as a result of your interaction with our Social Pages; for example, we may know the time and day when you liked one of our posts or sent a request via a message.

Many of your personal information may depend on the privacy settings you have chosen on the social media platform and on the content you choose to make public. Among this information may also be your first name, last name, some contact details, and the image associated with your social profile. Therefore, please note that some of your information is visible to Menabòh once you decide to follow our Social Pages. We invite you to review the privacy policies of the various social media and to check the privacy settings accordingly.

2. Categories of Personal Data Not Collected or Processed

Menabòh does not request, collect, use, or freely distribute personal data provided by persons under the age of 18. Should Menabòh become aware that data of a minor has been collected, it will delete them. If you do not meet the required age, please do not register or proceed with an online purchase and ask an adult (your parents or guardian) to carry out the necessary procedures.

3. Purposes and Legal Basis for the Processing of Personal Data

Personal data are collected and processed by Menabòh through electronic means and using electronic and IT tools, in accordance with the principles of necessity, lawfulness, fairness, proportionality, and transparency for the purposes and under the legal grounds (so-called “legal bases”) provided by the GDPR, as indicated below:

3.1 To Allow You to Browse Our Site and Enjoy the Offered Services

1. a) To provide you with the requested services (for example, managing registration and access processes on the Site, account management, customer support, handling any complaints, managing proposals, reviewing your order history, managing shipping and billing addresses, verifying the status of your orders, processing data for the provision of the individual services you request, such as purchase and collection at designated points).
   It is specified that users who choose to register on the Site: (i) enter their email and name in the Site form, (ii) receive a confirmation email with a link to their reserved area where they can set the password, and (iii) can view the data already provided during registration.
2. b) For the management of online orders (for example, carrying out the necessary online operations for order management; verifying that the information provided for the transaction is complete, valid, correct, and not fraudulent; processing the order and delivering the products; providing pre- and post-sale assistance services, including handling returns or managing legal guarantees; contacting you, also via email, for any issue related to order management or subsequent requests regarding the same. Please note that Menabòh requests payment method information and payment card details solely during the purchase process. These data will be securely transmitted to certified payment service providers for transaction authorization. Menabòh cannot view or access the full payment card details in any case.)
3. c) To provide you with assistance upon request through our customer service and to respond to your inquiry via email, telephone, or WhatsApp;
4. d) To allow you to access all benefits reserved for registered users (discounts, promotions, participation in prize draws, invitations and participation in events, etc.).
5. f) For recruitment and personnel selection purposes should you send your CV, either upon request or spontaneously. For these purposes, this privacy notice will apply, by which you authorize Menabòh to contact you to arrange an interview; the data will be kept for 12 months.

In all the cases mentioned above, the legal basis for the processing is the execution of a contract or the pre-contractual measures.

• 3.2 Interaction with Social Pages

  To allow you to interact with our Social Pages, post comments, express your liking for initiatives promoted by Menabòh, and share our posts, we will process your data to enable such activities and respond to your requests transmitted through these channels.

  3.3 Profiling and Marketing

  The legal basis for this processing is your consent, provided by accepting the cookies present on the Site. This consent can be revoked at any time through the cookie settings, as indicated in the Cookie Policy.

  In particular, regarding interaction with the Social Pages, if the user has given consent to the use of profiling cookies on the Site, Menabòh may also process the user's contact data (in particular, the email address) and data communicated during interaction with the Social Pages – such as information provided to the social media platform according to the privacy settings selected on that platform – in order to display marketing advertisements and content that are consistent with the user’s interests, based on the preferences and consumption habits identified through cookies and/or other tracking systems used by social media managers, including Meta Platforms Ireland Ltd. (“Meta”) and/or based on the analysis carried out by the social media themselves.

  Specifically, through digital platforms we may display marketing content and advertisements based on user interests, where the information regarding preferences, interests, consumption habits, spending limits, etc., has been acquired: (i) following profiling activity conducted on Menabòh’s Site and shared (even via APIs) with digital platforms, including Meta; or (ii) based on the match between the preferences and interests expressed by the user who visited the Site and accepted profiling cookies, and the user cluster identified by the digital platform (e.g., retargeting); (iii) using the targeting tools provided by digital platforms, including Meta, by defining the target of users potentially interested in Menabòh’s products and services and requesting the digital platforms to disseminate targeted advertising messages to users who match the defined target. In the event that the user interacting with the platform engages with that advertisement, such interaction may be evaluated for the effectiveness of the campaign, provided that the user has accepted the use of tracking tools—such as Meta’s Pixel—installed on the Site via cookie management tools (e.g., prospecting).

  Further information on the processing carried out through tracking tools is available in the Cookie Policy.

  3.5 Exercise of the Right to Defense

  Menabòh will process your personal data for the determination, exercise, or defense of a right in all competent forums. The legal basis for such processing is Menabòh’s legitimate interest. This legitimate interest does not prejudice the rights and freedoms of the users, as the processing is necessary for the exercise of the constitutionally guaranteed right of defense.

  3.6 Operation and Control of the Site and Compliance with Legal Obligations

  Menabòh may also process your data to determine liability in the event of possible computer crimes affecting the Site and to manage any conduct that violates the Service Terms. Menabòh will process your personal data in order to comply with obligations imposed by laws, regulations, or orders from competent authorities. The legal basis for this processing is the fulfillment of a legal obligation.

  3.7 Service Improvement

  Additionally, simultaneously with the communication of a completed purchase, Menabòh may ask you to provide feedback on the service received. Should you decide to offer your opinion on the service provided, the responses you provide will be processed in an aggregated form based on Menabòh’s legitimate interest in improving its services. Filling out the questionnaire is entirely optional; therefore, failure to provide the data will not affect your ability to use the Site or purchase the products and services offered by Menabòh, but it may result in partial inability to pursue the aforementioned purposes (for example, Menabòh might be unable to carry out marketing and profiling activities on products and services that might be of interest to the user).

  Finally, please note that browsing data is later used to derive anonymous statistical information on the use of the Site and to monitor its proper functioning. For further information, please consult our additional notices.

• 4. Nature of the Provision of Personal Data

  The provision of data marked with an asterisk in forms available on the Site is mandatory for the provision of the requested services, and failure to provide, provide incomplete, or untruthful data will result in the inability to deliver the requested service. The provision of personal data other than those indicated above is optional, and any refusal will not in any way affect the user’s ability to use the Site or purchase the products and services sold by Menabòh, but it may result in the inability, even if only partially, to pursue the purposes indicated above (for example, Menabòh might be unable to perform marketing and profiling activities on products and services that could be of interest to the user).

  5. Recipients of Personal Data and Transfer to Third Countries

  For the purposes of achieving the purposes indicated above, your personal data will be processed by authorized personnel of Menabòh as well as by authorized personnel of third parties operating as data processors (IT service providers and customer assistance, virtual infrastructures, CRM solution providers, companies offering data entry and postal services, brands, and, in the case of participation in prize draws or events, companies that handle the organization and management of contests and events on behalf of Menabòh). Furthermore, the data may be communicated to the following categories of recipients, who always act as data processors: companies within the Menabòh group for IT and logistical support, administration, and accounting; companies commissioned by Menabòh for sending promotional communications; digital platforms that, as part of marketing campaigns, process data on our behalf (e.g., Meta); and the payment service provider to enable the payment of purchases made on the Site, or their refund if applicable.

  With regard to payments made for purchases on the Site, data relating to the economic transactions are processed exclusively by the online payment providers in their capacity as independent controllers.

  Where strictly necessary for the purposes indicated above, your personal data may also be communicated to independent third-party data controllers, such as the competent authorities (for example, in case of illegal activities on the Site), notaries and chambers of commerce (in case of participation in prize draws), or PR companies (for event participation), legal, fiscal, or administrative consulting firms (if such communication is necessary or functional for the proper fulfillment of contractual obligations related to the services offered by the Site, including the purchase contract, as well as obligations deriving from law or in cases of determination, exercise, or defense of a right), to the acquirer (in order to enable payment of purchases), to the fraud prevention service provider (to perform an analysis of the order to identify any fraudulent transactions), to shippers, and to companies handling logistical support and managing collection points for the products purchased on the Site.

  In the event that you interact with the Social Pages, your data may be known by the companies that, as data processors, provide assistance and support to Menabòh in managing its profiles on the main social media platforms.

  Additionally, your personal data may be shared with digital platforms (including Meta) as independent data controllers or as joint controllers with Menabòh (in the context of marketing campaigns based on tracking users’ activities [e.g., retargeting and prospecting]).

  Personal data will not be disseminated or transferred to third parties for their own use; however, it is understood that in the case of extraordinary corporate operations (e.g., sale or lease of the company, merger, etc.), the data could be transferred or provided to third-party buyers/lessees or entitled parties.

  For specific requirements related to the location of the servers of Menabòh and/or its suppliers, Menabòh may use providers located in third countries outside the European Economic Area for the provision of its services. In such cases, Menabòh undertakes to guarantee adequate levels of protection and safeguards through contractual agreements, including the stipulation of standard contractual clauses pursuant to Article 46 of the GDPR.

  The list of recipients of the processing is available by writing to the addresses of Menabòh indicated in the “Contacts” section below.

• 6. Retention of Personal Data

  Menabòh retains users’ personal data only for as long as necessary to achieve the purposes described in Paragraph 2, in compliance with civil and tax retention obligations and the limits provided by the GDPR and applicable law.

  To this end, Menabòh specifies that the retention period for personal data for the purposes indicated above is as follows:

  1. Browsing the site and using the offered services (e.g., Site registration, purchasing products or services, and receiving service communications): the personal data processed for this purpose will be retained for a period of 10 years from the termination of the contract under which the above processing is carried out, in accordance with the applicable limitation period under the law.
  2. Interaction with the Social Pages: the personal data processed for this purpose will be retained for a period equivalent to that determined by each social page regarding the retention of posts and comments and, in general, user interactions on that page.
  3. Profiling and Marketing: the personal data processed for these activities will be retained for a maximum of 10 years.
  4. Exercise of the Right to Defense: personal data will be retained in accordance with the rules regarding the limitation periods concerning contractual/non-contractual offenses.
  5. Operation and Control of the Site and Compliance with Legal Obligations: the personal data processed for these purposes will be retained for as long as necessary to resolve any bugs or malfunctions of the Site, as well as for the entire period required by applicable legal regulations to which Menabòh must adhere.

  7. Security

  Menabòh acknowledges the importance of protecting users’ personal data (e.g., identification data and transaction data) collected on the Site. For this reason, Menabòh adopts technical and organizational security policies and measures to protect, in compliance with current regulations, users’ personal data and the IT systems used for managing the Site. In particular, Menabòh has implemented technical, legal, and organizational measures to protect personal data against accidental or intentional tampering, loss, destruction, disclosure, or unauthorized access to data collected online.

  However, although Menabòh continually implements and improves security measures in line with technological developments and industry standards, due to the very nature of the Internet, such measures cannot completely eliminate the risk of unauthorized access or data disclosure. It is therefore recommended to periodically update software used for data transmission protection (e.g., antivirus) and to verify that your electronic communication service provider has adopted appropriate measures for data transmission security (e.g., firewalls and anti-spam filters). Furthermore, please note that access to your personal account, which contains your personal data, is only possible via a username and password; to better protect your data, it is recommended that you do not disclose or make these details available to third parties.

  Regarding online purchases, the Site uses systems designed to ensure maximum security through the use of the most advanced technological and encryption systems (SSL).

• 8. User Rights

  8.1 As a data subject, pursuant to Articles 15 and following of the Regulation, you have the right to:

  • Receive confirmation of the existence of your personal data, access their content, and obtain a copy (right of access);
  • Update, modify, and/or correct your personal data (right to rectification);
  • Request deletion or restriction of the processing of data in the cases provided for by the Regulation, including if the data have been processed unlawfully or if retention is no longer necessary for the purposes for which the data were collected or otherwise processed (right to deletion and right to restriction);
  • Withdraw your consent, if given, at any time without affecting the lawfulness of processing based on consent prior to its withdrawal (right to withdraw consent);
  • Within the limits provided by the Regulation, receive a copy of the data you have provided in a structured, commonly used, and machine-readable format, and request that such data be transmitted to another data controller if technically feasible (right to data portability).

  You also have the right to object at any time to the processing of your data for direct marketing purposes, including profiling to the extent that it is connected to such direct marketing, and in cases where the processing is based on our legitimate interest (right to object).

  You may exercise your rights at any time by writing to: info@menaboh.com.

  When contacting us, please include your name, email address, postal address, and/or telephone number if provided, so that we can properly manage your request.

  Please note that requests for data deletion are subject to existing legal and regulatory obligations regarding document retention.

  Also note that to manage consents given via cookies, you should follow the indications provided in the Cookie Policy.

  Menabòh may ask you to verify your identity and will provide information regarding the action taken on your request within one month of receiving the request. In accordance with the Regulation, this term may be extended by two months if necessary, taking into account the complexity and number of requests; in such cases, Menabòh will inform you of the extension and the reasons for the delay within one month of receiving your request.

  At any time, you may lodge a complaint with the supervisory authority in case of a violation of data protection regulations. For further information, please visit: https://www.garanteprivacy.it/home/diritti/come-agire-per-tutelare-i-tuoi-dati-personali

  9. Contact Details of the Data Controller and the Data Protection Officer

  The Data Controller is: Menabòh Srl, with its registered office in Montevachi (AR), Via della Resistenza 6, 52025, VAT No. 02406260519, telephone +39 335 128 4851. Please note that at this time Menabòh does not use the services of a DPO for data management.

  10. Updates

  This privacy notice may be updated over time, also in view of changes to laws or regulations regarding the protection of personal data, and in such cases we will inform you. The modifications and updates will apply from the moment of their publication on the Site (in cases of modifications for which the applicable law requires obtaining consent, you will be allowed to freely express your choice). We therefore invite you to periodically review this page to verify the most up-to-date version of the Site’s privacy notice.

  Last updated: 09/02/2025

  For more information on how to exercise your rights, please refer to: https://www.garanteprivacy.it/home/diritti/come-agire-per-tutelare-i-tuoi-dati-personali

• NEWSLETTER PRIVACY POLICY

  1. Data Controller

  Pursuant to Articles 4 and 24 of EU Regulation 2016/679 (“GDPR”), the Data Controller is Menabòh Srl, with its registered office at Via della Resistenza 6, Montevarchi (AR) 52025, VAT No. 02406260519.

  1. Purpose of Processing | Legal Basis | Retention Period | Nature of Data Provision

  Purpose A

  • Purpose of Processing: Direct marketing through newsletter subscription: commercial/promotional information activities, invitations to events and/or manifestations promoted and/or organized by the Data Controller and/or joint controllers via email/newsletter. In order to compare and eventually improve the results of these communications, the Data Controller uses systems for sending newsletters and promotional communications that generate reports. Through these reports, the Data Controller may learn, for example, the number of readers, openings, unique clickers, and clicks; the devices and operating systems used to read the communication; details regarding individual user activity; and details of the emails sent (both delivered and undelivered) as well as forwarded emails. All these data are used for the purpose of comparing and, if necessary, improving the results of the communications.
  • Legal Basis: Consent – Art. 6(1)(f) of the GDPR.
  • Retention Period: Until such consent is revoked (opt-out).
  • Nature of Data Provision: Optional. Failure to provide consent for this purpose will prevent you from receiving newsletters.

  Purpose B

  • Purpose of Processing: Non-automated profiling with analysis of preferences, personal interests, etc., in order to send more tailored commercial proposals.
  • Legal Basis: Consent – Art. 6(1)(f) of the GDPR.
  • Retention Period: 12 (twelve) months.
  • Nature of Data Provision: Optional. Failure to provide consent for this purpose will prevent you from receiving newsletters that are better aligned with your preferences. The absence of such consent will not affect the possibility of being subscribed to our newsletter to receive marketing communications if you have provided consent for that purpose.

  Purpose C

  • Purpose of Processing: Communication of your data to third parties for marketing purposes. “Third parties” means the partners and sponsors of the Data Controller and similar entities within the Group.
  • Legal Basis: Consent – Art. 6(1)(f) of the GDPR.
  • Retention Period: Until an objection is raised (opt-out), to be exercised against the third party which, following the transfer of the data for marketing purposes, becomes an autonomous Data Controller for that marketing activity.
  • Nature of Data Provision: Optional. In the absence of consent, your data will not be transferred to the third party for marketing activities. This lack of consent will not affect the processing of your data for the other purposes for which you have given consent.
  1. Recipients

  To fulfill existing contracts or related purposes, your data will be processed by the Data Controller and by third-party companies contractually bound to the Data Controller. In particular, your data may be communicated to third parties belonging to the following categories:

  • (i) Internal personnel of Menabòh, who may have access to your data as they are responsible for carrying out certain processing operations related and instrumental to the management of the newsletter or marketing service;
  • (ii) Providers of services for managing the information system and telecommunications networks;
  • (iii) Freelancers, firms, or companies in the context of assistance and consulting relationships;
  • (iv) Providers of services for managing the activities indicated above for the stated purposes (e.g., entities responsible for communications, printing brochures, flyers, websites, videos);
  • (v) Managers of platforms for the services listed above (e.g., website hosting);
  • (vi) Competent authorities for compliance with legal obligations and/or for the fulfillment of requirements from public bodies, upon request.

  The subjects belonging to the above categories either act as data processors or operate independently as separate Data Controllers.

• The list of responsible parties is constantly updated and available at the Data Controller’s premises or by contacting the Data Controller at the addresses indicated in point 1 of this notice.

  1. Data Transfer to a Third Country and/or an International Organization

  The personal data provided will be transferred abroad to non-EU countries. In fact, the sending of newsletters is managed via the Mailerlite platform, owned by MailerLite Limited, based in Ireland, where your personal data may be transferred. Please be informed that the aforementioned company adheres to the so-called “Privacy Shield” agreement, which guarantees a level of protection for personal data that meets the standards required by the GDPR.

  1. Rights of the Data Subject | Complaint to the Supervisory Authority

  You may exercise your rights as expressed by the GDPR by contacting the Data Controller, by sending an email to marketing@menaboh.com. You have the right, at any time, to:

  • Request access to your personal data (Art. 15);
  • Request rectification of your personal data (Art. 16);
  • Request deletion of your personal data (Art. 17);
  • Request restriction of the processing of your personal data (Art. 18).

  Additionally, where applicable, you have the right to object (Art. 21) at any time to the processing of your data (including automated processing, e.g., profiling) as well as to withdraw the consent you have provided without affecting the lawfulness of the processing based on that consent prior to its withdrawal. If the processing is based on consent, you have the right to revoke your consent at any time without affecting the lawfulness of the processing based on the consent given before its revocation.

  To object to the processing or to exercise your other rights, you may write to marketing@menaboh.com. To stop receiving direct marketing communications, simply send an email at any time to marketing@menaboh.com with the subject “unsubscribe from newsletter” or use our automated unsubscription system provided for emails only, and you will no longer be contacted. To be excluded from profiling activities only, send an email to marketing@menaboh.com with the subject “no profiling.” Without prejudice to any other administrative or judicial recourse, if you believe that the processing of your data violates the GDPR, pursuant to Art. 15(f) of the aforementioned GDPR, you have the right to file a complaint with the Data Protection Authority (supervisory authority www.garanteprivacy.it). Where applicable, you also have the right to data portability (Art. 20), and in that case the Data Controller will provide your personal data in a structured, commonly used, and machine-readable format. The Data Controller informs you that no automated decision-making process is in place.

  1. Modification of the Privacy Notice

  The Data Controller reserves the right to modify, update, add to, or remove parts of this privacy notice at its discretion and at any time. In order to facilitate such verification, the notice will include the date of the last update.