PRIVACY POLICY

Privacy Notice for Users

Version:  29.10.2026 

- Triboo Digitale S.r.l., with registered office at Viale Sarca 336, Building 16, 20126 Milan, VAT number / tax code and Milan Companies Register number IT02387250307 (hereinafter “Triboo”) 

- and BALTIMORA STUDIO S.r.l., with registered office at Via Aliprandi 19, 20900 Monza (MB), code IT10771680963 and registered with the Milano Monza Brianza Lodi Companies Register, REA MB 2556228 (hereinafter the “Partner” and, together with Triboo, the “Controllers”), acting as Joint Controllers of the Personal Data of users (hereinafter “Users”) who browse and use the Services available on www.theandamane.com (hereinafter the “Website” and the “Services”), provide this Notice pursuant to Article 13 of Regulation (EU) 2016/679.

This Website and the Services are reserved for persons aged 18 or over. The Controllers do not collect Personal Data relating to persons under the age of 18.

The Controllers attach the utmost importance to Users’ right to privacy and the protection of their Personal Data. For information about this Notice, Users may contact the Controllers at any time as follows:

For Triboo:

By sending a registered letter with acknowledgement of receipt to the Controller’s registered office (Viale Sarca 336, Building 16, 20126 Milan);

By sending an email to triboospa@legalmail.it

By sending a fax to 02/64741491

For Baltimora Studio S.r.l.:

- By sending a registered letter with acknowledgement of receipt to the Controller’s registered office at Via Aliprandi 19, 20900 Monza (MB);

- By sending an email to: customercare@theandamane.com.

The Data Protection Officer (DPO) appointed by Triboo may be contacted at: curinigalletti@triboo.it

Baltimora Studio has not appointed a Data Protection Officer (DPO), as it is not subject to the obligation to designate one under Article 37 of the Regulation.

1. Purposes of Processing

Users’ Personal Data will be processed by Triboo pursuant to Article 6 of the Regulation for the following purposes:

• contractual obligations and provision of the Services, to enable Users to browse the Website, perform the Terms of Use accepted by Users when registering and/or using the Services, and fulfil Users’ specific requests. The Data collected are: first name, surname, email address and personal information. In the absence of specific Consent for further purposes, Users’ identity must be verified, including by email, with service communications being sent. Administrative and accounting purposes, to carry out organisational, financial and accounting activities.

• legal obligations, to comply with obligations imposed by law.

Providing Personal Data for the purposes set out above is optional; failure to provide such Data will prevent Users from browsing and registering on the Website and from using the Services.

Personal Data required for the processing purposes described in this Section 1 are marked with an asterisk in the Registration Form on the Website.

2. Additional Marketing Purposes

With the User’s freely given and optional Consent, certain Personal Data may be processed by the Partner to contact the User by email, landline and/or mobile telephone, automated systems and/or human operators, SMS and/or MMS, and to offer products or services of the Partner and/or third parties, offers, promotions and commercial opportunities.

Refusal to give Consent will not affect the ability to register on the Website in any way.

Where Consent has been given, the User may withdraw it at any time by submitting a request to the Partner using the methods set out in Section 6 below.

The User may also easily object to further promotional emails by clicking the Consent withdrawal link included in each promotional email. Once Consent has been withdrawn, the Partner will send the User an email confirming the withdrawal. Users wishing to withdraw Consent to promotional telephone calls while continuing to receive promotional emails, or vice versa, should send a request to the Controller using the methods set out in Section 6 below.

After exercising the right to object to promotional communications, Users may continue to receive some promotional communications for a limited period for purely technical reasons. In that event, Users are invited to contact the Partner to report the problem.

For the tracking of promotional emails and the option to disable tracking alone, Section 3 bis below applies.

3 Additional Purposes of Processing: newsletter

With the User’s freely given and optional Consent, Personal Data may be processed to send a periodic newsletter containing promotions on the Website and/or The Andamane initiatives.

Refusal to give Consent will not affect the ability to register on the Website in any way.

Where Consent has been given, the User may withdraw it at any time by submitting a request to the Controller using the methods set out in Section 6 below.

The User may also easily object to further promotional communications by clicking the Consent withdrawal link included in each email containing the newsletter. Once Consent has been withdrawn, the Partner will send the User an email confirming the withdrawal of Consent. For any tracking of promotional communications and newsletters, and for withdrawal of Consent to tracking alone, please refer to Section 3 bis below.

3 bis. Tracking in Email Communications

In the promotional communications and newsletters referred to in Sections 2 and 3, Baltimora Studio S.r.l. may use tracking pixels, namely small images hosted on remote servers which, when the images in the message are loaded, allow its opening to be detected and linked to the recipient.

Depending on the features enabled, the Data processed may include recipient and message identifiers, the date and time of openings, and technical information such as the IP address and the type of device or email client. Blocking image loading may prevent the pixels from functioning.

Baltimora Studio uses individual tracking to measure email openings and assess the effectiveness of its promotional communications. Individual tracking is optional and is carried out on the basis of the User’s Consent, pursuant to Article 122 of Legislative Decree No. 196/2003 and Articles 6(1)(a) and 7 of the Regulation. For new processing activities, Consent may be collected together with Consent to promotional communications, provided that the request also expressly discloses the tracking. Consent to cookies on the Website does not, in itself, constitute Consent to tracking in emails.

For processing activities involving tracking that were already ongoing on the date of entry into force of the Italian Data Protection Authority’s Guidelines of 17 April 2026, based on Consent or another valid legal basis, the relevant transitional provisions apply: Baltimora Studio promptly notifies Users of this addition to the Notice and makes it possible to withdraw Consent to tracking alone. This regime does not remedy any previously unlawful processing or permit new processing activities to be initiated without the necessary Consent.

The User may at any time choose to stop receiving promotional communications or disable tracking alone while continuing to receive communications without tracking pixels. These choices may be made through the preferences management link included in emails or by writing to: privacy@theandamane.com. Refusing or withdrawing Consent to tracking does not restrict access to the Website, purchases or other Services. Withdrawal does not affect the lawfulness of processing carried out before it. Baltimora Studio records preferences and applies them to subsequent messages, including automated communications.

Information about email openings is not used to determine the User’s tastes, interests or purchasing habits. Any introduction of such activities will require a specific addition to the Notice and separate Consent to Profiling, where necessary.

Consent may be dispensed with for exclusively aggregate statistics only in the cases provided for by Article 122 of the Italian Privacy Code and the Italian Data Protection Authority’s Guidelines: the behaviour of individual recipients must not be measurable, and related technical data must be effectively anonymised. Merely aggregating Data previously collected and retained at an individual level does not exempt tracking from the Consent requirement. Baltimora Studio S.r.l. does not regard Data as anonymous if they still allow the recipient to be identified, even indirectly.

This Section concerns tracking in Baltimora Studio S.r.l.’s promotional emails and newsletters and does not authorise the inclusion of pixels in transactional order-related communications managed by Triboo. Any use of trackers in such messages requires a separate assessment of the applicable conditions and adequate information to Users. Tools used on the Website remain subject to their respective notices and applicable conditions.

4 Processing Methods and Retention Periods

The Controllers will process Users’ Personal Data using manual and electronic tools, in a manner strictly related to the purposes pursued and, in all cases, ensuring the security and confidentiality of the Data.

Users’ Personal Data will be retained for as long as strictly necessary to fulfil the primary purposes described in Section 1 above, or as otherwise necessary to protect the interests of both Users and Triboo.

For the Marketing and newsletter purposes referred to in Sections 2 and 3, Personal Data are retained for as long as strictly necessary and, in any event, for no longer than twenty-four (24) months [1], subject to earlier withdrawal of Consent. The specific retention period set out below applies to email tracking.

Individual opening Data collected through pixels under Section 3 bis are retained for a maximum of 12 (twelve) months from the recording of each event and, in any event, for a shorter period when no longer necessary or where Consent to the relevant processing is withdrawn. Each opening does not restart the retention period for previously collected Data. Only the evidence strictly necessary to document Consents and withdrawals and to comply with the User’s choices is retained separately, for as long as necessary for those purposes and the protection of rights, with restricted access and without further promotional use of Data for which Consent has been withdrawn.

5. Data Recipients and Transfers

Users’ Personal Data may be accessed by the Controllers’ employees and/or personnel responsible for managing the Website and all Services connected with their provision. These persons, who have received instructions from the Controllers pursuant to Article 29 of the Regulation, will process Users’ Data solely for the purposes set out in this Notice and in compliance with Applicable Law.

Users’ Personal Data may also be accessed by third parties processing Personal Data on behalf of the Controllers as “Data Processors”, including, by way of example, IT and logistics service providers supporting the operation of the Website and/or Services, outsourcing or cloud computing service providers, professionals and consultants.

For sending emails and managing preferences and tracking under Section 3 bis above, Baltimora Studio uses email delivery and campaign management service providers, appointed as Data Processors under Article 28 of the Regulation where the relevant conditions are met. An up-to-date list of providers and information on the safeguards applied to any transfers outside the European Economic Area (EEA) may be requested from Baltimora Studio using the contact details above. The roles of the parties involved depend on the activities actually performed; joint controllership in relation to the Website does not automatically mean that Triboo determines the purposes and means of campaigns and tracking managed by Baltimora Studio.

Users are entitled to obtain a list of any Data Processors appointed by each Controller by submitting a request to the relevant Controller using the methods set out in Section 6 below.

Any transfers of Personal Data outside the European Economic Area (EEA) take place in compliance with Chapter V of the Regulation, on the basis of an applicable adequacy decision or appropriate safeguards, such as the Standard Contractual Clauses (SCCs) adopted by the European Commission and, where necessary, supplementary measures. Information on the applicable mechanism and how to obtain a copy of the safeguards may be requested from the relevant Controller using the contact details provided in this Notice.

Furthermore, Triboo may disclose Users’ Personal Data, insofar as necessary and essential to perform contractual obligations, to third parties acting as independent Data Controllers, such as payment service providers and logistics service providers required to deliver goods sold through the Website. These independent Controllers will process Users’ Data solely for the proper fulfilment of orders relating to the Services.

6. Data Subjects’ Rights

Users may exercise the rights afforded to them under Applicable Law by contacting the Controllers as follows:

By sending a registered letter with acknowledgement of receipt to the Controllers’ registered offices:

- for Triboo: Viale Sarca 336, Building 16, 20126 Milan

- for Baltimora Studio S.r.l.: Via Aliprandi 19, 20900 Monza (MB)

By sending an email to:

- for Triboo: triboospa@legalmail.it

- for Baltimora Studio: privacy@theandamane.com

By sending a fax to:

- for Triboo: 02/64741491

Triboo handles requests relating to the processing referred to in Section 1.

Users have the right to obtain information about: (i) the source of their Personal Data; (ii) the purposes and methods of processing; (iii) processing carried out using electronic tools; (iv) the identity of the Controllers and Data Processors; (v) the recipients and categories of recipients to whom the Data may be disclosed.

The Partner handles requests relating to Sections 2, 3 and 3 bis. With regard to Section 3 bis, the User may disable tracking alone while remaining subscribed to communications, using the preferences management link included in emails or by writing to privacy@theandamane.com. This is without prejudice to the User’s right to exercise their rights against each Joint Controller in respect of processing carried out under joint controllership pursuant to Article 26(3) of the Regulation.

Users also have the right to:

a) access, update, rectify and supplement their Data;

b) have their Data erased, anonymised or blocked;

c) obtain confirmation that the operations referred to in points a) and b) above have been notified to the recipients, unless it is temporarily or permanently impossible to carry out such operations.

Users also have the right:

a) to withdraw Consent at any time where processing is based on their Consent;

b) where applicable, to Data portability (the right to receive all Personal Data concerning them in a structured, commonly used and machine-readable format), restriction of the processing of Personal Data and erasure (the “right to be forgotten”);

c) to object:

i) on legitimate grounds or grounds otherwise consistent with the purpose of processing;

ii) in whole or in part, to the processing of Personal Data concerning them for the purposes of sending advertising materials, direct selling, market research or commercial communications;

iii) where Personal Data are processed for direct marketing purposes, at any time to the processing of their Data for such purposes, including Profiling insofar as it is related to such direct marketing.

d) where the processing concerning them infringes the Regulation, to lodge a complaint with a supervisory authority (in the Member State of their habitual residence, place of work or place of the alleged infringement). The Italian supervisory authority is the Garante per la Protezione dei Dati Personali (GPDP), located at Piazza Venezia 11, 00187 Rome, https://www.garanteprivacy.it/home/footer/contatti

[1] Decision of the Italian Data Protection Authority (GPDP) entitled “Loyalty Cards and Safeguards for Consumers” of 24 February 2005.