I. Information applicable to all users

Who we are  
Ken Scent S.p.a. with registered office in Via Aldo Moro 45, 30020 – Quarto D’Altino, VE – Italy.

REA VE – 445717, Tax Code and VAT number 04735350276.

We operate the website kenscent.com

For the purposes of the data protection laws of the European Union, in particular the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 relating to the protection of individuals with regard to processing of personal data, hereinafter “GDPR”), Ken Scent is the data controller of your personal data.

You can contact our Data Protection Officer (“DPO”) by emailing privacy@kenscent.com or by post, sending your request to the Ken Scent offices.

What kind of personal data we collect and use, for what purposes and on what legal basis
The nature of the personal data we collect and use, as well as the purposes of the processing and the related legal bases on which the processing is based, depend on the type of user and on the different use of the Platform, Site, App or Services by of the latter. In particular:
• if you are a user of our Site or App who uses one or more of our Services, the provisions in Section II of this Policy apply;
• if you are a professional who uses the Platform and the Services on a professional basis, having also entered into a Services Contract, the provisions set out in Section III of this Policy apply;

If Ken Scent processes your personal data based on its legitimate interest pursuant to art. 6.1(f) of the GDPR, Ken Scent will have carried out a test on the balance of his interests with your fundamental rights, in order to make sure that the latter are not harmed or put at risk by the exercise of our legitimate interest. Remember that you can always contact us to express your opposition to the processing carried out by us (see the paragraph “What are your rights regarding the processing of personal data”, below).

Sharing your data with third parties
We may share your personal data with external suppliers, for the sole purpose of providing you with the requested Services. Unless we inform you otherwise, and you are asked for the relevant consent for the transfer of data to another data controller, each of these third parties acts as a data processor on our instructions, and has entered into an appointment agreement of the controller with us in accordance with Art. 28 GDPR. Among them are:

• cloud hosting and server maintenance service provider,
• providers of telephone or digital communication tools,
• providers of customer service tools,
• external consultants, auditors or advisors,
• payment service providers, banks, credit reference and fraud prevention agencies, and insurance companies,
• IT companies that provide us with software or similar services,
• third parties with whom acquisition, merger, investment or corporate reorganization proceedings are in progress or planned.

Some of the aforementioned third parties may be located outside the European Union. In this case, it is our obligation to ensure that the legal requirements are met to proceed with the transfer of data in complete safety, and we will in any case remain responsible for respecting your rights and legal obligations in relation to the personal data transferred.

Finally, we may disclose your data to comply with any legal or regulatory requirements or dictates, to enforce compliance with our policies or Terms of Use, to contact judicial authorities or other public authorities or to comply with their legitimate requests, or to protect our rights. We may also share your personal information with other corporate entities, in the event of a merger, acquisition or investment in that corporate entity, or in the event of a corporate reorganization.

Except in the cases mentioned above, we will not transfer your personal information to third parties without your consent.

What are your rights regarding the processing of personal data
Pursuant to the GDPR, and regardless of the type of use of the Platform and the Services you make, you have the following rights:
• you have the right to be informed about the processing of your personal data (i.e. for what purposes, what type of personal data, to which recipients they are communicated, retention periods, any third-party sources from which they were obtained, verification of automated decisions , including profiling, the logic used, as well as the significance and expected consequences). This Information, as well as (where applicable) the provisions of the Services Contract or any other information or notifications relating to the processing of personal data made available by Ken Scent, fulfill your right to be informed;
you have the right to: 

• ask us for a copy of the personal data we process; or to erase (if you believe we do not have the right to keep it) or to rectify (if you believe it is inaccurate) your personal data;
• object to, and therefore limit, the processing of your data by us (in which case, you will only have access to those features of the Services that do not require the type of processing to which you have objected);
• revoke any consent to data processing previously given by you (the withdrawal of consent does not affect the legitimacy of the processing carried out before the revocation itself, or on the basis of legal conditions other than consent);
• request the “portability” of your data stored by us in digital format (that is, to receive the personal data concerning you in a structured format, commonly used and readable by an automatic device, in order to transfer them to another data controller, or to obtain this transfer directly, if this is technically feasible), preferably by contacting us in the manner indicated in the “Contact” section of this Policy;
• you have the right to lodge a complaint with our DPO (preferably by contacting us in the manner indicated in the “Contact” section of this Information) or, if your complaint is not resolved satisfactorily by us, the Personal Data Protection Authority (accessible through the website www.garanteprivacy.it/) if you believe that we are processing your personal data in a manner contrary to the law;

We will always comply with our legal obligations regarding your rights as a data subject, to allow you to fully exercise them. We will try to respond to you within a reasonable time and, in any case, within a month (or within the times we will communicate to you immediately in the case of complex or numerous requests). We reserve the right to charge a reasonable fee (which reflects the costs of providing the information) or to refuse to respond when requests are manifestly unfounded or excessive, in which case we will explain the situation to you and notify you of your rights. We also reserve the right to verify the identity of the applicant, to avoid sharing your personal data with unauthorized third parties.
We aim to ensure that the information we hold about you is always accurate. To help us keep your information up to date, you will need to take care to inform us of any changes to your personal data. Following a report or request from you, we will ensure that your personal data in our possession is accurate and updated.

Automated decisions and profiling
We do not use personal data processing that results in decisions based entirely and solely on the automated processing of your personal data. We do not use any profiling system or tool to process your data, nor fully automated decision-making processes based on your personal data.

Links to other websites
Our Site and our App may contain links to other sites, apps or platforms, including through “social” buttons. Although we make every effort to ensure that these links are always directed to sites, apps or platforms that share our high standards for respecting privacy, we are not responsible for the content, security or privacy policies of other websites, and a link on our Site does not constitute an endorsement of that site. Once you transfer to another site, app or platform, you are subject to their terms and conditions (including their privacy policy and underlying practices). We encourage you to review the terms of service and related privacy notices or policies applicable to those sites, apps, or platforms before sharing your personal data with them.

How we protect your data
Ken Scent adopts appropriate technical, physical, electronic, operational and administrative security measures to protect your personal data from unauthorized access. We follow industry-accepted standards to protect the personal information provided to us, both during transmission and after it is received: for example, periodic security testing of the Platform, data segmentation and access control within the organization, and use of pseudonymisation, anonymisation or encryption techniques. Unfortunately, the transmission of information via the internet (including e-mail) is not always completely secure. Despite our constant effort to ensure maximum protection of your personal data, we cannot guarantee the security of your data when transmitting it to our Site, App or Platform, especially if the transmission takes place in insecure ways . The user therefore assumes the risk arising from this transmission. Once we have received your information, we will use strict procedures and appropriate security features to prevent any unauthorized access or sharing.

Contact us
For any questions relating to your personal data, you can contact us:

• via our Contact Form on the Site,
• by email to: privacy@kenscent.com
• by mail to the address of our registered office: Via Aldo Moro 45, 30020 – Quarto D’Altino, VE – Italy
• if you are a Registered Professional who has signed a Services Agreement, by contacting our Contact Center as for other inquiries relating to your Account.

II. Section dedicated to users of the Platform
If you are a user of our Site or App this section applies to you.

A) What personal data we process; how we collect them; for what purposes, and on what legal basis, we process them

1. Account creation and registration to use our Services
We collect your personal data directly when you register on our Site or App, to use the Services, or when you book a videoconference session through the Platform. At the time of registration or booking, we ask you to provide basic data, including your email address and telephone number, your first name, last name, gender, birthdate. We save this information in our systems to enable you to use the Services.
Our Services allow you, among other things, to: book videoconference sessions, communicate in chat with specialists, save your personal information in your Ken Scent Account, and publish on the Site your opinion about your experience during the visit.
When you register to use our Services, or book a videoconference session, you therefore accept the Terms of Use by clicking in the relevant box, and therefore enter into a legally binding contract. The need for us to execute the obligations of this contract and to allow you to access the Services constitutes a valid legal basis for the processing of your personal data, as specified in article 6.1(b) of the GDPR.

2. Use of the Services
Reservations: When you book a videoconference session, through the Site or the App, we will obtain further personal data from you, including for example:

• name and surname,
• age,
• gender,
• telephone number,
• email address,
• date and time of the visit,
• reason and type of videoconference session,
• any additional information you decide to share during the videoconference booking process.

We will store this data within the Platform and pass it on to the professional we have selected. After transmitting your personal data, the professional selected by us will become the independent owner of the processing of your data, for purposes determined by them (for example, to provide you with his services). This treatment will be subject to the professional’s personal data treatment and retention policy.
Furthermore, we will be able to send you (by telephone message or e-mail) a communication confirming the reservation, and/or a reminder before the date of the videoconference session; and we will notify you in case of cancellation. After the videoconference session, we may contact you to ask you to write a review of your experience on the Site.
Chat with professionals.
Through our platform you can also start a chat with a professional selected by us: we will know about it but we will not access it, and the contents of these conversations will remain private between you and the specialist.
You can review the history and content of chats or messages at any time.
The need, on our part, to implement the conditions of service and to allow you to access the Services, constitutes a valid legal basis for the processing of your personal data, as specified in article 6.1(b) of the GDPR.
However, some of the personal data that you share with us during the booking process is or could be considered (singly or jointly) data relating to your health, and therefore worthy of specific protection under the GDPR. For further information relating to the legal basis for the processing of this data, you can refer to Section II(B) of this information (“Do we process data relating to your health?”).

3. Write a review or public question
When you decide to post a review on the Site about your experience with a professional, we may collect some of your personal data (for example, if you include identifying data, and/or describe the reason for your visit or details about your health condition). For this reason, we will ask for your consent to the processing of health data. The processing of health-related personal data on the basis of consent complies with Article 9.2(a) of the GDPR.
Remember that your reviews will be made public. We advise you not to enter any information of a private or sensitive nature, as what you publish will be visible to all users of the Site.

4. Communications
As a user of the Services with your own Account, you will receive communications from us relating to topics that may be of interest to you (i.e., closely related to the Services you use): for example, communications relating to new features, new products, Services add-ons, promotions, news and other topics relating to the Services or news regarding Ken Scent initiatives that may be of interest to you.
The legal basis for sending these communications (by telephone message or e-mail) is the legitimate interest pursuant to Article 6.1(f) of the GDPR. Nonetheless, since these are communications of a potentially commercial nature, you will always have the right to object to receiving them, in which case we will stop contacting you, with the exception of (a) service communications sent by professionals through our Platform relating to videoconference sessions from you booked through the Platform (for example reminders, cancellations, requests from the specialist, invitations to review), which come from the professional assigned to you (who uses our Services) and not from us (see Section II(D) of this Disclosure “We also act as data processors on behalf of professionals” ); and/or (b) other service communications, of a non-commercial nature relating to your Account or the Services (for example: changes to the contractual conditions, malfunction notifications, messages of a legal or regulatory nature).

Other data and purposes of processing 
As part of the use of the Site, the App or the Platform, we may obtain other types of data, including, for example: information relating to your device (computer or mobile phone), IP address, time zone and language, or the browser you use. We will also collect information relating to the timing, methods and duration of your use of the Services (first and last use, duration of the session in the Account). If you use the App, we may also obtain data on your location via GPS (you will always have the option to disable this feature directly on your mobile device).
We will process these sets of data of a technical nature (the “Metadata”) to:

• respond to, and defend against, any complaints (yours or third parties) relating to the Services and your use of them, and/or
• manage and plan our business activities (for example, how our users will use our Services in the future and estimate trends on their needs and preferences). In this case, in most cases the data used will be anonymised (for example, the way you navigate on our website), but in some cases the data, if read together with other data, could reveal your identity.

We process this information on the basis of our legitimate interests, which constitute a legal basis for the processing of personal data according to Article 6.1(f) of the GDPR. Remember that you will have the right to object to the processing of this data at any time.

B) Do we process data relating to your health status?
In some of the following cases:

• when you book a videoconference session with a professional using the Platform,
• if you write a review on the Site which includes personal data of a health nature,
• if, via the Platform, you start a chat conversation with a professional or send the latter one or more communications sharing information relating to your state of health, and/or
• if you use features or Services similar to those listed above,

we may obtain access to personal data relating to your health, which are worthy of specific protection under the GDPR.
We will therefore need your prior consent to the processing of this data, which we will ask you from time to time. Your consent is, in this case, necessary to be able to use the aforementioned Services; in fact, we could not provide them to you without being able to process this data. The processing of your health data based on your consent complies with Article 9.2(a) of the GDPR. You may withdraw your consent at any time, in which case we will not be able to continue providing you with the Services for which the sharing of such data is necessary.

C) Is it possible to provide personal data of other people?
If you book a visit or appointment on behalf of another person (for example, for a member of your family who is a minor), you authorize us to collect that person’s personal data. We will process your personal data for the same purposes for which we treat yours, applying the same policies and security measures.

D) We also act as a data “processor” on behalf of professionals who work with Ken Scent.
Our Services allow our network of professionals to send chat messages to users via our Platform.
In this case we simply act as data controllers (pursuant to Article 28 of the GDPR), in the name and on behalf of the professionals, and always and only on the basis of their instructions and indications; never for our independent purposes.
We assume no responsibility for communications that you may receive directly from professionals through their direct channels, for which we are not aware.
If you do not wish to receive such messages, or want to exercise your rights regarding your personal data processed by a professional, we suggest that you contact him directly asking not to be reached by messages anymore.

E) Conservation and cancellation of your data
With respect to the personal data provided by you pursuant to sections II(A), (B), and (C) above, which we process as a “data controller” (under the GDPR) on the basis of our relationship direct with you, we will only keep them in our systems for as long as necessary for the purposes indicated above or as necessary to comply with a legal obligation to which we are subject.

The period we keep your data will vary depending on the type of information and the purposes for which we use it. In general, we will keep our records for up to 6 years after your relationship with us ends, to comply with our legal obligations. For more information, see the following table:  

F) Sharing of your data with third parties
In addition to the cases illustrated in Section I of this Information, when you book a videoconference session with a professional or one using the Platform, or when you communicate your data to him through the Platform (such as, for example, in the context of a chat, a private conversation or completing a pre-visit questionnaire), with your consent we will transmit your personal data to them in order to be able to provide you with the Services you have requested. Your consent is, in this case, necessary to be able to complete the booking and intermediation services between you and the professional; without this data, we cannot in fact provide you with these Services.

Once we have received your data, the professional will become the independent controller of the processing of your personal data, for its own purposes and distinct from those identified in this Information (for example, for treatment purposes, or in order to fulfill its obligations contracts towards you if you decide to make use of its services).

III. Section dedicated to professionals registered on the Platform
If you are a professional who uses the Platform and the Services on a professional basis, and you have entered into a Services Agreement, the following provisions apply.

A) What personal data we process; how we collect them; for what purposes, and on what legal basis we process them

1. Creation of the Account, registration on the Platform and use of the Services
You provide us with your data when signing the Services Agreement.
When you sign the Services Agreement, we will collect data relating to your professional activities and other information useful for creating your Account and your profile on the Platform, which will be visible to users. The information provided may include or concern, inter alia:

• your name and surname,
• the address where you carry out your professional activity,
• your email address and/or your telephone number used to carry out your professional activity;
• your training and specialization and the sector or type of activity you are involved in,
• your professional license number,
• your image,
• the opinions or reviews of users about their experience with you, e
• any other information you provide to us when entering into a Services contract.

You will have the possibility to manage your profile on the Platform directly and independently, and decide which personal data will be published.
When you sign the Services Agreement, a legally binding agreement is created. The need for us to execute the obligations of this contract and to allow you to access the Services constitutes a valid legal basis for the processing of your personal data, as specified in article 6.1(b) of the GDPR.
If you have entered into a Services Agreement, further information relating to the processing of your personal data, and the personal data of third parties that you may provide us in the context of using the Services, can be found in the Services Agreement.

2. Communications
As a Registered Professional, you will receive communications from us relating to topics that may be of interest to you (i.e., closely related to the Services you use): for example, communications relating to new features, new products, additional or ancillary Services, promotions, news and other topics related to the Services or news regarding Ken Scent initiatives that may be of interest to you.
The legal basis for sending these communications (by telephone message or e-mail) is the legitimate interest pursuant to Article 6.1(f) of the GDPR. However, as these are communications of a potentially commercial nature, you will always have the right to object to receiving them, in which case we will stop contacting you, except for communications of a non-commercial nature relating to your Account, the Services or the Services Agreement (for example : changes to the contractual conditions, notifications of malfunctions, messages of a legal or regulatory nature).

3. Other data and purposes of processing
As part of your use of the Services, we may obtain other types of data, including, for example: information relating to your device (computer or mobile phone), IP address, time zone and language, or the browser you use . We will also collect information relating to the timing, methods and duration of your use of the Services (first and last use, duration of the session in the Account).
We will process these sets of data of a technical nature (the “Metadata”) to:

• respond to, and defend against, any complaints (yours or third parties) relating to the Services and your use of them, and/or
• manage and plan our business activities (for example, how our customers will use our Services in the future and estimate trends on their needs and preferences). In this case, in most cases the data used will be anonymised (for example, the way you navigate on our website), but in some cases the data, if read together with other data, could reveal your identity.

We process this information on the basis of our legitimate interests, which form a legal basis for the processing of personal data under Article 6.1(f) of the GDPR. Remember that you will have the right to object to the processing of this data at any time.

B) Storage and deletion of your data
Regarding the personal data provided by you when registering on the Platform or in the context of the provision of the Services, which we treat as a “data controller” (pursuant to the GDPR) based on our relationship with you, we will only keep in our systems for as long as necessary for the above purposes or as necessary to comply with legal obligations to which we are subject.

The period we keep your data will vary depending on the type of information and the purposes for which we use it. In general, we will keep our records for up to 6 years after your relationship with us ends, to comply with our legal obligations. For more information, see the following table: