EU, Swiss and UK Privacy Policy

JULY 2024

This policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it. It is important that the personal data we hold about you is accurate and up to date. Please let us know if any of your personal data (for example, your name or address) changes during your relationship with us so that we can update our records.

This privacy policy explains:

• Who we are;
• Your rights;
• What personal information we collect;
• How we use your personal data;
• Who we share your information with and why;
• How we keep your information secure;
• How long we keep your data; and
• How to contact us.

In this document, “We”, “Us” and “Our” refer to Think Water S.r.l., with registered office in Italy, in Cittadella (PD), Via delle Pezze, 35, VAT number 03985480288 (also “Data Controller”).

1. Who we are

For the purposes of the legislation on the protection of personal data, the Data Controller is part of the Gruppo Culligan International (“Culligan“), a global leader in providing cleaner, softer water through innovative, sustainable solutions and unmatched service across all industries.

With more than 13,000 team members and 1,000 dealers in 90 countries, Culligan’s more than 35 brands serve more than 50 million customers each year and share a mission to bring better water to consumers wherever they need it – at home, at work and on the go.

For consistency, this Privacy Policy has been prepared taking into account the main processing activities carried out by the companies of the Culligan Group, without prejudice to the possibility for each company of the Group to integrate this Policy in order to take into account its own organizational needs.

If you are a resident of the EU, the European General Data Protection Regulation (the “GDPR”) will apply to this Policy, as well as, if applicable, the applicable local law that has implemented or adopted the GDPR.

We have also entered into an intra-group agreement containing the Standard Contractual Clauses approved by the European Commission to ensure that all transfers of personal data to any Culligan entity are protected to the same level as required by European data protection law.

2. Your rights

You have the right to:

• Ask us if and how we are processing your personal data and for what purpose;
• Obtain a copy of the personal information we hold about you (right of access);
• Update or correct your personal data (right of rectification);
• Request the erasure of your personal data; and
• Request, under certain conditions, to restrict the processing of your personal data (right to restrict processing).

Additionally, in certain circumstances you have the right to:

• object to the processing of your personal data (the right to object);
• object to automated decision-making and profiling (the right not to be subjected to automated decision-making, including profiling);
• and request that information about you be provided to a third party in a commonly used and machine-readable form (the right to data portability).

Exercising your rights

For information about your rights, including how to correct, restrict, delete, amend your personal data or if you would like to request a copy of the personal data we hold about you, you can contact us by clicking here.

Expenses

Access to your personal information (or the exercise of any of the other rights) will not normally involve any charge to you.

In some cases, we may charge a reasonable fee if your request for access is manifestly unfounded or excessive, or if you require multiple copies of the information. Alternatively, we may refuse to comply with your request in these circumstances.

What we need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

If you are not satisfied with our response or would like more information about your data protection rights, you can visit the official website of your local Data Protection Authority (also known as a “DPA”).

• In the UK, see the web site dell’Information Commissioner’s Office (ICO).
• In the EU, you can find your DPA here.
• In Switzerland, consult the Federal Data Protection and Information Commissioner (IFPDT).

3. What personal information we collect

“Personal data” means any information relating to an individual that can be directly or indirectly identified. This information includes personal data such as your first and last name, email address and telephone number, job title, department, preferences and our communications with you.

Information provided by the user

We will collect your personal data if:

• fill out a contact form on our website;
• contact us for information or assistance on our products and services;
• enter into a contract with us;
• register for a free trial;
• access our portal and/or any of our applications;
• participate in a survey;
• request to download e-books, guides, product data sheets or other resources on our website;
• participate in events of a commercial or promotional nature;
• interact with us through our social media channels;
• consent to receive marketing communications from us;
• and/or apply for a job offer.

This information may include personal data, such as your full name, email address, and telephone number.

Information we collect about you

The type of personal information we collect depends on the purpose for which it is collected and may include:

• Information about you to identify you and manage your relationship with Think Water (e.g., name, address, email, postcode, telephone number(s);
• Information about your contractual relationship with us (e.g. customer number, order history, etc.);
• Copy of documentation (e.g. bank statements, letters, invoices, correspondence);
• Financial and economic information (e.g. payment card numbers, bank details, payment history; on behalf of financial institutions we also collect certain data related to the purchase of devices financed by a loan (e.g. pay slips, proof of address etc.);
• Audio and visual information, if you visit one of our locations where a video surveillance system (for example, CCTV) is installed;
• Marketing/Communications Data (for example, information relating to marketing and external communications, such as marketing campaigns, opt-in information and preferences); where we have used consent as a lawful basis for contacting you, this can be withdrawn at any time;
• Lifestyle information (e.g. volume of water consumption, mineral/vitamin supplements, Information needed to choose the right appliance for your home, such as the number of people living in the home in question, tap water consumption, electricity consumption);
• Information about your visit to the website, the Internet protocol (IP) address used to connect your computer to the Internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform, including the full Uniform Resource Locators (URL) clickstream to, through and from our website (including date and time); products viewed or searched for; page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page and any phone number used to call our customer service;
• Employment and education information (e.g. employer details, relevant professional qualifications, etc.)

We may also collect information about you from other sources, such as:

• other companies in the Culligan Group;
• external third parties (for example, credit reference agencies to verify your identity and financial standing, event coordinators if you are present at a stand);
• and from cookies (cookies are small text files that are placed on your computer by websites that you visit. They are widely used in order to make websites work, or work more efficiently, as well as to provide information to the owners of the site).
•  

4. Come utilizziamo i vostri dati personali

We will only use your personal data when the law allows us to do so and for the purposes set out in this policy. These are:

• When you give your consent;
• When it is necessary for the performance of a contract we have entered into or are entering into with you;
• If necessary to comply with a legal or regulatory obligation;
• For our legitimate interests or those of a third party, provided that your interests and fundamental rights and freedoms do not prevail over those interests.

We may use your personal data to provide and administer the services you request and/or to respond to your queries. If you do not provide us with certain information, we may not be able to process your request.

We may also use your personal data to comply with our legal obligations, to handle any complaints and to enforce our terms and conditions.

We may use your personal data for our legitimate business interests, which include security purposes, improvements to our website, improvements to our solutions and services and for general marketing and internal monitoring and reporting purposes. However, we will not do so if our interests are overridden by your interests, rights and freedoms.

We process your information for the following purposes

Below we have provided a description of how we intend to use your personal data in compliance with the principles of lawfulness provided for by the legislation.

(A) To perform our contract with you and to support and maintain that relationship. This includes the following:

• to register you as a prospective or new customer;
• to process and deliver your order, including managing payments, fees and charges and collecting and recovering any sums owed to us;
• as part of our recruitment and selection activities.

The provision of your personal data, indicated in points (i), (ii) and (iii) is optional, but failure to provide such data may make it impossible to perform the requested services. For such cases, consent to the processing of personal data will not be requested as such processing falls within the provisions of Article 6, paragraph 1, letter b) of the Regulation, without prejudice to the provisions of Article 111 bis of Legislative Decree 196/2003 with regard to the purpose referred to in point (iii).

(B) Comply with legal and regulatory requirements. Such requirements include the following:

confirm your identity for regulatory purposes;

• detect and prevent fraud;
• to comply with our data protection obligations.

For the purposes referred to in points (iv), (v) and (vi), the processing of your personal data is carried out pursuant to art. 6, par. 1, letter c) of the Regulation.

(C) For specific commercial purposes, in order to provide you with adequate products and services and a safe experience. Our commercial purposes include the following:

• to manage our relationship with you, including notifying you of changes to our terms or privacy policy and/or asking you to leave a review or participate in a survey;
• to send you commercial communications by email about products and services similar to those you have purchased, unless you have expressly opted out of receiving such communications (“Soft Spam”);
• to send you newsletters, to keep you updated on new products or services or to recommend other goods or services that may be of interest to you, to inform you of special offers and to invite you to our events;
• to provide you with relevant content and advertising on the website and to measure or understand the effectiveness of such advertising;
• to use data analytics to improve and develop our website, products/services, marketing, customer relationships and experiences;
• to manage and protect our business and website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and data hosting).

The processing of your personal data for the purpose referred to in point (viii) constitutes legitimate processing pursuant to the applicable legislation on the protection of personal data, which does not require your consent. You may object to the processing for this purpose at the time of purchase or in the event of communications subsequent to the purchase of products and services by the Data Controller by writing to the addresses indicated in this information notice, as well as using the link found at the bottom of each communication sent by email.

For the purposes referred to in points (vii), (ix) and (x), the processing of your personal data is carried out pursuant to art. 6, par. 1, letter a) of the Regulation.

For the purposes referred to in points (xi) and (xii), the processing of your personal data is carried out pursuant to art. 6, par. 1, letter f) of the Regulation.

We may also process your personal data in order to comply with a legal obligation to which we are subject or, finally, for the pursuit of a legitimate interest of ours or of third parties, including any defensive purposes, in compliance with the conditions and constraints provided by the applicable law

In the near future, we may also use AI technologies and data from the Internet of Things “IoT”, including machine learning, to carry out certain activities. In this case, the result will be subject to human control and review and we will not include your personal data in any data analysis with a third-party model without informing you. Where we use publicly available models for general commercial purposes, we will give you the option to be anonymized or omitted from the data provided. We will always try to use AI technologies in line with legislation, regulatory guidance and government policies.

Change of intended use

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. We may also process your personal data as part of an acquisition or sale. If this is the case, we will notify you of any changes to the processing or controller of the data resulting from this activity.

You have the right to object to our processing of your personal data for some of the marketing purposes listed above, but if we do this, it may impact our ability to provide you with some or all of our services. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

5. How we keep your information safe

Ci impegniamo a garantire la riservatezza delle informazioni personali in nostro possesso e continuiamo a rivedere i nostri controlli di sicurezza e le relative politiche e procedure per garantire la sicurezza delle vostre informazioni personali.

Quando stipuliamo contratti con terzi, imponiamo loro obblighi di sicurezza, privacy e riservatezza per garantire che le informazioni personali siano mantenute al sicuro e impedite da accessi, elaborazioni, copie, modifiche, cancellazioni, perdite o utilizzi non autorizzati o accidentali.

Se lavoriamo con terze parti in paesi al di fuori del Regno Unito o dell’Unione Europea, ci assicuriamo che si tratti di paesi che il governo britannico e la Commissione Europea hanno confermato avere un livello adeguato di protezione dei dati personali, o che l’organizzazione che riceve i dati personali abbia fornito garanzie adeguate e accetti di trattare i vostri dati con lo stesso livello di protezione che avremmo noi.

Utilizziamo inoltre gli accordi internazionali di trasferimento dei dati del Regno Unito e le clausole contrattuali standard dell’UE per i trasferimenti al di fuori del Regno Unito o dello Spazio economico europeo.

In circostanze limitate, i dati possono essere consultati da dipendenti al di fuori delle nostre sedi operative abituali.  In tali circostanze, ci assicuriamo che vengano adottate misure di sicurezza adeguate per salvaguardare le informazioni dell’utente.

6. Con chi condividiamo le vostre informazioni e perché

We will not sell your personal data and generally will not provide it to third parties, but there are some exceptions. We may share your personal data in the following ways (as appropriate):

• Culligan Group Companies:
  • for administrative, analytical and statistical purposes;
  • to test the IT systems operated by our companies;
  • to produce a consolidated view of our relationship with you in order to improve the services we can offer you;
  • to send you marketing communications that you have consented to receive, or that we think may interest you based on the services you receive from us or other companies in our group;
  • to provide service messages relevant to our relationship with you;
  • to handle complaints and fulfil data subject rights (such as the right of access).

• Companies engaged by Think Water (these third parties may be based in countries outside the UK or the European Union):
  • with third parties or service providers who provide additional data about you to improve our ability to design and develop new products and services that can be marketed and sold to meet the needs of the consumer groups we have identified and are targeted accordingly;
  • with debt collection agencies for debt collection and recovery purposes;
  • with payment service providers to enable payments to be completed;
  • with our accountants for tax returns and to support legal reporting;
  • with our legal advisers or auditors;
  • with information technology and cyber security providers;
  • with third parties or service providers to conduct market research on our behalf to help us improve and develop the products and services we provide to you and other customers;
  • with a prospective purchaser (or its advisers) for due diligence purposes if we are considering a sale of all or part of our business. For example, in the event of a merger, acquisition, divestiture, change of control, or liquidation of Think Water or any portion of its business (or in contemplation of such event), we may share your personal data as part of that extraordinary transaction, where necessary to fulfill our obligations under this Policy.

• Organizations and individuals nominated by you or authorized by you;
• Public authorities:
  • for the purposes of preventing or detecting crime and/or other offences, we may share the personal data collected by us with law enforcement agencies, other public or private sector agencies, government bodies or representatives, in accordance with applicable legislation, in order to comply with any legal obligation or as otherwise permitted by law. This includes public authorities, insurance companies, financial companies and/or other agencies.

7. Data retention

We will only retain your personal data for as long as necessary to fulfil the purposes for which we collected it, including for the purposes of satisfying any legal, accounting or reporting requirements. Where processing is based on your consent, we will only process your personal data until your consent is withdrawn.

To determine the appropriate retention period for personal data, we consider the amount, nature and quality of the personal data, the potential risk of harm from unauthorised use or disclosure of personal data, the purposes for which we process personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Personal data processed for the purposes referred to in points (i) and (ii), falling within the scope of Article 6, par. 1, letter b) of the Regulation, will be retained for:

(a)       the period of 10 (ten) years starting from the termination of the contract; or, in the event that the interested party does not conclude a contract with the Data Controller following the establishment of a pre-contractual negotiation, for

(b)      the period of 24 (twenty-four) months from the start of the negotiation.

For the purpose referred to in point (iii), your personal data will be retained for the period of 24 (twenty-four) months starting from the transmission of the curriculum vitae, without prejudice to the longer retention obligations provided for in the event of the establishment of a subordinate or self-employed employment relationship, coordinated and continuous collaboration, an agency mandate and/or the possible assignment of a sales assignment or a commercial relationship.

The personal data processed for the purposes referred to in points (iv), (v) and (vi), falling within the scope of Article 6, paragraph 1, letter c) of the Regulation, will be retained for the period provided for by the applicable legal provisions.

For the purpose referred to in point (viii), your personal data will be retained until you object to the processing by writing to the contact details in Article 1 of this notice or through the link at the bottom of each email sent.

For the purposes referred to in points (vii), (ix) and (x), your personal data will be processed, as a general rule and without prejudice to the principle of data retention proportionate to the purpose of the processing, until you withdraw your consent. If you withdraw from a pre-contractual negotiation without having revoked such consent, the data may be processed even after your withdrawal.

For the purposes referred to in points (xi) and (xii), your personal data will be processed for the period strictly necessary to achieve the legitimate interest of the Data Controller.

We will take all reasonable steps to ensure that your personal data is processed securely and in accordance with this notice.

8.How to contact us

If you have any questions about this policy, or if you require further information about our privacy practices, or if you wish to raise a complaint about how we have handled your personal data, you may contact the Owner by clicking here. For information about your rights, including how to correct, restrict, delete, amend your personal data or if you would like to request a copy of the personal data we hold about you, you can contact us by clickin