This privacy policy (“Privacy Policy”) for the PlaNet service describes the purposes and methods of processing personal data (“Personal Data” or “Data”) that Up2You S.r.l. carries out for users who access and use the services of the PlaNet digital platform (“Platform”).

This policy is provided only for the Up2You S.r.l. Platform and not for other services that may be accessed by the user via external links.

Following access to and navigation of the Platform, data relating to identified or identifiable persons may be processed. We may receive personal information from the user following the creation of a personal profile for the completion of missions and the provision of our services.

1. Who is the Data Controller?

The Data Controller is Up2You S.r.l. (“Up2You”, “We”, “Company” or “Controller”) with registered office at Via Londonio 1, Milan, 20154.

2. What Personal Data do we collect?

Through our digital Platform, we collect and process Personal Data in several ways:

• Personal Data provided voluntarily by the user: we collect personal information about the user when it is actively provided to us, for example when the user registers to create a personal profile and when they upload images and videos to the Platform to complete missions and earn points, gaining e-coins.
• Personal Data collected through the use of the Platform: we automatically collect certain personal information during the user's browsing and use of the PlaNet service. The Platform is a web app accessible via browser, both from desktop and smartphone, only by users involved in the initiative. The management of accounts linked to the service ensures a periodic review of the same and disables all users not associated with business processes or a specific profile. The periodic account review by Up2You is performed every month, in order to ensure the processing and storage of only the Personal Data that is strictly necessary.

1. What type of Personal Data do we process?

• Information regarding the user's account:we collect the Personal Data that the user provides to us for the creation of their personal account (First Name, Last Name, company email address, company name, and password). We process the Personal Data contained within photographs and videos that the user may upload to their profile to demonstrate that they have completed the assigned missions. We may also process personal information related to the use of the Platform that allows us to improve theuser experienceand, in general, the interface and navigability of the Platform to maximize ease of use and user engagement.
• Location data:we can approximate the user's location based on their IP Address.
• Data for Platform management: we ensure a periodic review of accounts and disable all users not associated with business processes or an identified profile. The periodic account review is performed every month. Up2You records the date of the last connection and deactivates access for users who have been inactive for more than 90 days since their last login. We regularly check the Platform access system to ensure the security of our users and perform an automatic log-off after a period of user inactivity. If the data subject wishes to continue using our services, they may access the system again following a new identification and authentication procedure. The automatic log-off is set to 60 days from the moment the personal profile is created.

2. Automatically collected information

When you use our Platform, whether interacting with us via smartphone, computer, or mobile device, we may automatically collect information about how you access and use the Platform, as well as information about the device you use to access the services offered by PlaNet. We use this information to improve the user experience and to monitor and update our Platform. We generally collect this information through a variety of tracking technologies, including cookies, pixels, web beacons, embedded scripts, location-identifying technologies, and similar technologies (collectively, “tracking technologies”).

Users can accept or reject these technologies by modifying their privacy preference settings in their web browser's profile settings.

The information we collect automatically may be combined with other personal information we collect directly from users.

The information we may collect automatically includes:

• information regarding the use of the Platform(for example, whether they use the services offered by Up2You, complete missions, upload images or videos, or use the account);
• Personal Data related to interactions with our Platform(for example, whether or not a user clicks on an image or link, views the blog, or completes the multiple-choice quizzes we provide);
• information about the devices used to access and interact with the Platform(for example, this allows us to know whether you are using a computer, tablet, or smartphone, as well as your screen resolution, operating system, Wi-Fi connection, internet browser, IP address, and server log file information).
• Behavioral data: information derived from the combination of device ID and system events that can be used to identify trends and behavioral patterns to improve our service;
• analytical information: we may collect analytical data, or use third-party analytics tools, to help us better understand our users' needs.

3. What Personal Data do we not collect?

We do not collect or process the following Personal Data regarding the user:

• racial or ethnic origin;
• political opinions;
• religion or philosophical beliefs;
• health or medical conditions;
• criminal record;
• trade union membership;
• Genetic or biometric data;
• sex life or sexual orientation.

We ask our users not to send, upload, or disclose any of the Personal Data mentioned above through the Platform or directly to our contacts.

4. Why do we process your Personal Data?

Users' Personal Data is processed on our Platform to:

1. Allow the user to register on the Platform and create their account

We may process your data to allow you to access the Platform and register by creating a personal account. By creating your personal profile, you will be able to access services, complete missions, and increase your points and e-coins. To activate your profile, we may request the following personal information:

• User's first and last name;
• Corporate email address;
• Name of the company for which they work;
• Reference password.

Furthermore, we may process Personal Data related to images contained in photographs and videos regarding the missions conducted. Each mission, if completed, may entitle the user to two types of bonuses:

• ECOin: a type of "currency" that allows you to redeem rewards;
• points, which allow you to climb the system's internal leaderboard and earn rewards.

It is not possible to modify the "game mechanics" by excluding one of these bonuses, changing them, or adding a third. The allocation of these bonuses for each mission is defined by Up2You.

For account security purposes, we ask that you select "strong" passwords of at least 8 characters, including alphanumeric characters and symbols.

Legal basis for processing: the provision of the service to users who decide to register for the PlaNet platform.

2. Answering questions and fulfilling user requests 

To respond to requests and questions regarding missions, points, and the ECOin system that the user sends using the contact details provided by Up2You. We may respond to requests via email to support you in managing your account.

Legal basis for processing: managing user requests in an appropriate and timely manner and ensuring the service offered by Up2You.

3. Sending update emails to our users

To keep our users up to date on the PlaNet service and missions, we send automated emails ("transactional emails") that each user is free to accept or decline based on their preferences set within the Platform. Please note that these emails are intended solely for registered users and may concern the addition of new missions to the Platform with a "call to action," or may refer to leaderboard updates, notifications regarding completed/incomplete missions, or notifications regarding redeemed rewards.

Legal basis for processing: the user's prior explicit consent to receive such communications.

Please note that users always have the option to opt out of receiving update communications, even if they have previously given their consent, simply by unsubscribing from the service or by notifying us via email.

4. Providing news on the Platform

The Platform includes a "news" section, which contains educational news (including, for example, information regarding completed missions), updates, and tips on using the Platform. In the event that the user has authorized us to share their photo or video in the news section, we may upload the image or video and make it available to the specific community that has access to the Platform.

Legal basis for processing: our legitimate interest in keeping our users updated on the services provided and missions completed. Where videos and/or images are shared, we will request the prior consent of the data subject.

5. Ensuring the technical functioning of the Platform

We collect and use the user's Personal Data to technically administer the Platform and ensure it functions correctly. We may use the personal information provided by the user to respond to reports or complaints regarding the proper functioning of PlaNet.

Legal basis for processing: our legitimate interests in ensuring the proper technical and IT functioning of the Platform.

6. Informing the user about changes to the terms and conditions of use of the Platform and providing this Privacy Policy

To send information regarding changes to the terms and conditions of use of the Platform and to provide this Privacy Policy.

Legal basis for processing: our legitimate interest in informing the user well in advance of the entry into force of such changes.

7. Compliance with legal obligations

To comply with our legal obligations and orders from government authorities, which may include measures from authorities outside the user's country of residence, when we reasonably believe we are required to make such disclosures and when the disclosure of Personal Data is strictly necessary to comply with said legal obligations or government orders.

Legal basis for processing: compliance with our legal obligations.

8. Conducting market research and satisfaction surveys following the service provided

To conduct market research and/or satisfaction surveys regarding the service provided by Up2You. Such research will be used to provide statistical samples useful for improving the activities promoted by the Company.

Legal basis for processing: our legitimate interest in collecting information regarding the quality of the service provided for the purpose of improving Up2You's services.

9. Understanding the preferences and tastes of users of the Up2You Platform

We collect the user's Personal Data to better understand the tastes and preferences of Platform users, in order to tailor our offerings to our users' characteristics.

Legal basis for processing: the data subject's prior explicit consent to profiling.

10. Preventing fraud and abuse

We will use information regarding fraudulent or criminal activity related to the use of our services for the purposes of detecting and preventing fraud or abuse.

Legal basis for processing: our legitimate interests in protecting our organization from fraudulent activity.

11. Legal protection of our interests

To enforce our terms and conditions of service, protect our business operations, safeguard our rights, privacy, safety, or property, and/or that of our affiliates, and to allow us to pursue available legal remedies or limit any damages we may sustain.

Legal basis for processing: our legitimate interests in protecting our organization in accordance with the law.

5. To whom is the user's Personal Data communicated?

In addition to personnel duly authorized by Up2You to process the Personal Data of users who use our Platform, the information provided by the data subjects may be communicated to your reference company.

The Personal Data of users who use our Platform may also be processed by some of our service providers who handle the technical maintenance of the systems.

If necessary, Personal Data may be transmitted to the competent public and judicial authorities in order to prevent potential fraud or illicit acts.

6. What are the user's rights regarding the processing of Personal Data, and how can they be exercised?

The subjects to whom the Personal Data refer have the right at any time to obtain confirmation of the existence or otherwise of such Data and to know their content and origin, verify their accuracy, or request their integration, updating, or rectification (Articles 15 and 16 of the Regulation), specifically:

• Right of access.The right to obtain access to personal information concerning the user along with certain related information;
• Right to data portability.The right to receive personal information in a common format and to have it transferred to another data controller;
• Right to rectification.The right to obtain the rectification of Personal Data without undue delay if the personal data are inaccurate or incomplete;

Pursuant to Articles 17, 18, and 21 of the Regulation, you have the right to request the erasure, restriction of processing, anonymization, or blocking of Data processed in violation of the law, as well as to object in any case, for legitimate reasons, to their processing, specifically:

• Right to erasure.The right to obtain the erasure of your Personal Data without undue delay in certain circumstances, such as when the Personal Data are no longer necessary in relation to the purposes for which they were collected or processed;
• Right to restriction of processing.The right to obtain, in specific circumstances identified by applicable law, a restriction on the processing of your Data for a certain period of time, for example when you contest the accuracy of the Personal Data, for the time required to verify the accuracy and correctness of such Data.
• Right to objectThe right to object, on grounds relating to your particular situation, to the processing of Personal Data, and to object to the processing of Personal Data for direct marketing purposes, to the extent that it is related to such direct marketing.

As a data subject, you also have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

These rights may be exercised by contacting the Data Controller and/or the Data Protection Officer at the following addresses:

• e-mail:privacy@u2y.io
• by mail, atvia Londonio 1, Milan 20154

7. How long do we keep Personal Data?

The management of service-related profiles ensures a periodic review of accounts by the Company, which disables all users not associated with business processes or a specific profile. The periodic account review is carried out every month. Up2You records the date of the last login and deactivates access for users who have been inactive for more than 90 days since their last login. In the event of contract termination, there is a procedure in place to delete all accounts and the information associated with them. We monitor the proper use of accounts and automatically log off users after a period of 60 days of inactivity.

Up2You is committed, in accordance with the terms of service indicated on our Website, to safeguarding the data entered by the user and making it available to them for processing through the tools offered by our services. Up2You reserves the right to retain anonymized or aggregated customer information for statistical use, aimed at improving the services provided based on a legitimate interest.

What transfers might we make?

We may share some of your personal data and information with our suppliers for activities related to the use of the services offered through the Platform and to your reference company. We do not currently transfer Personal Data outside the European Economic Area. In the future, for some of the processing mentioned above, we may use providers and suppliers located outside the European Union. In such circumstances, we ensure that we will commit to complying with applicable legal provisions regarding data transfer by entering into, if necessary, agreements that guarantee an adequate level of protection and/or by adopting the standard contractual clauses provided by the European Commission.

8. How do we protect your Personal Data?

Information security is very important to us, and we have implemented safeguards to preserve the integrity and security of the information we collect and process through the Platform.

However, no security system is impenetrable, and we cannot guarantee the security of our systems 100%. In the event that any information under our control is compromised as a result of a security breach, we will take reasonable steps to investigate the situation and, where appropriate, notify those individuals whose information may have been compromised and take other steps, in accordance with applicable laws and regulations.

9. Governing Law

This Privacy Policy is governed by and shall be interpreted in accordance with the provisions and any other mandatory regulations applicable in the European Union.

10. Complaint to the Data Protection Authority

The data subject has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali), which can be contacted via their website https://www.garanteprivacy.it/.

‍

‍

PLANET COOKIE POLICY

A service by Up2You

1. Introduction

The Cookie Policy (“Cookie Policy”) of the PlaNet digital platform (“Platform”), owned by Up2You S.r.l., describes the different types of cookies used in relation to the Platform, which you can access and browse.

Up2You S.r.l. (“Up2You”, “We” or “Company”) is the data controller for the Personal Data described in this Cookie Policy and determines the purposes and means pursuant to Regulation (EU) 2016/679 (“GDPR”).

What are cookies?

Cookies are small text files that can be used by websites and digital platforms to make the user experience more efficient. Cookies allow us to store small amounts of information on your computer or mobile application regarding your visits to our Platform.

Why do we use cookies?

We use cookies for various purposes. Necessary cookies are used to ensure the proper functioning of the Platform.

We may also collect information about how users use the Platform in an anonymous form, such as: pages visited, time spent, traffic sources, geographic origin, age, gender, and interests. These cookies are sent by third-party domains external to our Platform.

How do we use cookies?

We may store cookies on your device if they are strictly necessary for the operation of the Platform. For all other types of cookies, we need your consent.

What type of cookies do we use?

This Platform uses different types of cookies. Some cookies are placed by third-party services that appear on our pages.

You can change your browser cookie settings at any time to allow you to use all features without restriction when browsing the Platform. We invite you to read the PlaNet service Privacy Policy, which contains full information about who we are, how we process Personal Data, and how you can contact us.

Below, we indicate the types of cookies we use when you browse our Platform.

• Necessary cookies

Necessary cookies help make the Platform usable by enabling basic functions like page navigation and access to secure areas. Our Platform and services cannot function properly without these cookies.

• Preference cookies

Preference cookies allow us to remember information that changes the way the Platform behaves or looks, such as your preferred language or the region that you are in.

• Statistical cookies

Statistical cookies help us understand how visitors interact with us by collecting and reporting information anonymously.

• Marketing cookies

Marketing cookies are used to track visitors across the Platform. The intention is to display ads that are relevant and engaging for the individual user.

• Unclassified cookies

Unclassified cookies are cookies that are in the process of being classified, along with the individual cookie providers.

Below are the links to the respective cookie policies and the provided consent forms:

• Google:https://www.google.com/policies/technologies/types/ 
• Analytics:https://tools.google.com/dlpage/gaoptout?hl=en-GB

Cookie settings and preferences.

You can decide whether or not to accept cookies by using your browser settings. Disabling technical cookies, either partially or fully, may affect the optimal use of the Platform. Disabling "third-party" cookies does not affect navigability in any way. Browsers allow you to define different settings for "first-party" and "third-party" cookies.

For example, in Firefox, through the Tools->Options->Privacy menu, you can access a control panel where you can define whether or not to accept different types of cookies and remove them. Documentation on how to set cookie management rules for your browser is easily available online; for example, here are some links for the main browsers:

Chrome: https://support.google.com/chrome/answer/95647?hl=en

Firefox: https://support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computer

Internet Explorer: http://windows.microsoft.com/en-us/windows7/how-to-manage-cookies-in-internet-explorer-9

Safari: http://support.apple.com/kb/HT1677?viewlocale=en_US