POLICY REGARDING THE PROCESSING OF PERSONAL DATA OF ONLINE USERS - COOKIE POLICY PURSUANT TO REGULATION (EU) 2016/679, ("GDPR")

	DATA CONTROLLER
	Hexagon S.p.A., via Giorgio e Guido Paglia n. 1 / D 24122 Bergamo, Tax Code and VAT number 04058560162 ("Company"). The Data Protection Officer can be contacted at the following email address: dpo.hexagon@percassi.it

	PERSONAL DATA
	Browsing data.

	COOKIE POLICY
	WHAT ARE COOKIES Cookies are data created by a server which are saved in text files on the hard disk of a computer or on any device used by the user to access the Internet (smartphone, tablet), and allow for the gathering of information regarding the navigation carried out by the user on the website. Cookies can be saved permanently on your computer and can be of variable duration (known as persistent cookies), but can also disappear on closure of the browser, or be of limited duration (known as session cookies). Cookies can be installed by the website being visited (known as first party cookies) or by other websites (known as third party cookies).
	HOW WE USE COOKIES 1. Technical cookies a. session/browsing: The use of session cookies (which are not permanently saved on the user’s computer and which disappear when the browser is closed) is strictly limited to the sending of session identifiers (made up of numbers randomly generated by the server) which are necessary in order to allow safe and efficient exploration of the website and its applications. The session cookies used by the bathandbodyworks.it website avoid the need for other IT techniques which are potentially detrimental to the confidentiality of navigation carried out by the users, and do not allow the gathering of personal data identifying the user. They do not require consent. b. Persistent cookies:The use of session cookies (which are not permanently saved on the user’s computer and which disappear when the browser is closed) is strictly limited to the sending of session identifiers (made up of numbers randomly generated by the server) which are necessary in order to allow safe and efficient exploration of the website and its applications. The session cookies used by the bathandbodyworks.it website avoid the need for other IT techniques which are potentially detrimental to the confidentiality of navigation carried out by the users, and do not allow the gathering of personal data identifying the user. They do not require consent. 2. Analytic Cookies: : cookies installed to collect aggregate information of a mainly statistical nature (how long you stay on a web page, number of visitors to the site ...). a. First-party analytic cookies: similar to technical cookies as they are installed directly from the site you are visiting to improve its usability. They do not require consent. b. Third party analytic cookies: analytic cookies created and installed by third parties in order to analyse user navigation for the creation of statistics on visits, or to improve the content, show products of a certain category and, if necessary, place targeted advertising on the websites visited. The system used is Google Analytics, which is a web analysis service supplied by Google LLC (“Google”). Like other systems, Google Analytics employs cookies to allow the website to analyse how users use the website. The IP address is anonymized so no personal data relating to the user will be sent to Google. The user may, in any case, refuse to accept the cookies by selecting the relative setting on their browser, but this may hinder the use of all of the functions of the website. Since the IP address is anonymized, the third-party analytic cookie does not require your consent for it to be installed. 3. Profiling cookies: these are cookies used to track users' web browsing and create profiles on his/her tastes, habits, choices, etc. These cookies can be used to send advertising messages to users' computer in line with preferences expressed by the users themselves when navigating on-line. a. First-party profiling cookies: used and installed by bathandbodyworks.it to collect information on the user's browsing habits with the aim of proposing advertising messages that are as appropriate as possible to their interests. This means that they are also used to limit the number of times in which a user sees a particular advert: for bathandbodyworks.it the result is more efficient communication, for the user the result is advertising which is less invasive, and which better reflects their interests. During navigation within the bathandbodyworks.it website, promotional cookies allow for confirmation that the user is viewing the advertising messages, displaying promotional content which can be of interest according to what has previously been visited. These cookies also allow the display of promotional messages regarding recently-consulted content from the bathandbodyworks.it website while the user continues to browse other websites. The bathandbodyworks.it website uses promotional cookies in an exclusively anonymous manner: the advertising is targeted, but the user is not identifiable. Promotional cookies used are permanent, although they remain on the user’s device for a limited period of time. They require consent. b. Third-party profiling cookies: HOW WE USE COOKIES used and installed by third parties to track user browsing on the web and create profiles on tastes, habits, choices ... These cookies are managed by third-party companies such as Richrelevance, Criteo, Google, Zanox. Social buttons/widgets, i.e. those special “buttons” which depict the icons of the various social networks (for example Facebook and Twitter), can also be found on the bathandbodyworks.it website. These buttons allow users who are browsing the website to directly reach and interact with social networks with just a simple a click. By clicking social buttons/widgets, the social network in question acquires data regarding the visit by the user to the bathandbodyworks.it website, and at the same time it issues its own profiling cookies.
	MANAGEMENT OF COOKIE PREFERENCES The consent to the use of cookies is given in one of the following ways: -          by clicking "OK" button found in the banner containing brief information, which appears when the user visits the site;
	HOW TO EDIT COOKIE SETTINGS Most internet browsers are initially set up to accept cookies automatically. This means that the user can, at any time, set their browser to accept all cookies, only certain cookies, or to refuse them, disabling their use by websites. Furthermore, the user can usually set their browser preferences in such a way as to be advised every time a cookie is saved by their computer. At the end of each browsing session, the user can also cancel the saved cookies from their device hard disk. If you want to eliminate the cookies installed in the cookie folder of the browser used, you need to remember that each browser has different procedures for the management of settings. By clicking on the links below, the user may receive specific instructions regarding some of the most common browsers: : Microsoft Windows Explorer Google Chrome Mozilla Firefox Apple Safari If the user does not want to receive Google Analytics cookies, he can do so by connecting to this page.  To learn more about cookies in general, please visit this page. To learn more about behavioural advertising and on-line privacy, please visit this page. To learn more about Google Analytics cookies, please visit this page. To learn more about Criteo cookies used on our site, please visit this  page.

Cookies	Name	Purposes	First/third party	Legal basis	Duration	Additional information
Google Analytics	_ga, _gid, _gat_UA-182264911-1	Analytical	Third party	Consent	2 years, 24 hours, session	Privacy Tecnologies You can download a browser plug-in to permanently refuse Google Analytics cookies at the following link
Salesforce	__cfduid, dw_dnt, dwac_79274e1bf418c9661f0605c78d, dwanonymous_1f003973f94c071136c81c60b9fbf0b9, dwsid	Technical	First part	Automatic	sessione, dw_anonimous -> 180 giorni	https://documentation.b2c.commercecloud.salesforce.com/DOC2/index.jsp
Salesforce	__cq_dnt	Analytical	First part	Automatic	session	https://documentation.b2c.commercecloud.salesforce.com/DOC2/index.jsp
Browsing - Browser	sid	Technical	First part	Automatic	Session	https://documentation.b2c.commercecloud.salesforce.com/DOC2/index.jsp
Google Tag manager	_dc_gtm_UA-182264911-1	Technical	First part	Automatic	session	The Google privacy policy and cookie methods of use are available at the following link. For further information on Google cookie management: click here. For further information on how Google uses cookies: click here. To enable or disable cookies: click here.
Criteo	UID, ZDI	Profiling	Third party	Consent	2 months	Criteo privacy policy and cookie methods of use are available at the following link.
Google Adwords	IDE, NID, ANID	Profiling	First part	Consent	6 months, 13 months, 6 months	The Google Adwords privacy policy and cookie methods of use are available at the following link. To customise ads, please visit this page. For further information on Google cookie management: click here. For further information on how Google uses cookies click here. To enable or disable cookies: click here.
Facebook	_fbp	Profiling	Third party	Consent	Session	Facebook privacy policy and cookie methods of use are available at the following link.
Iubenda	_iub_cs-301828, _iub_cs-23960187-granular, _iub_cs-23960187	Technical, Analytic	Third party	Consent	6 months	The Iubenda policy and cookie methods of use are available at the following link.

	MANDATORY NATURE OF THE PROVISION OF DATA
	The personal data processed via the installation of first party technical and analytical cookies is necessary in order to guarantee the correct navigation within the website. Granting consent for the installation of third party and profiling cookies is optional. Your personal data will be processed by said cookies only if you have expressed you consent in the aforementioned manners.

	DATA RECIPIENTS
	Data may be processed by external parties operating as autonomous controllers such as, for example, authorities and supervisory and control bodies. Data may also be processed, on behalf of the Company, by external parties designated as Processors, who are given appropriate operating instructions. These parties are essentially included in the following categories: a. companies that offer e-mail sending services; b. companies that offer services instrumental to the pursuit of the purposes indicated in this disclosure (IT suppliers, site management and maintenance company, etc.)

	AUTHORISED PROCESSORS
	The data may be processed by employees of the business departments in assigned to fulfil the purposes indicated above, who are expressly authorised for the processing and have received appropriate operating instructions.

	TRANSFER OF PERSONAL DATA TO COUNTRIES OUTSIDE OF THE EUROPEAN UNION
	No transfers of personal data are made to countries outside the European Union.

	RIGHTS OF THE DATA SUBJECT - LODGING OF COMPLAINTS WITH THE SUPERVISORY AUTHORITY
	By contacting the Privacy Office, by post at the address Hexagon S.p.A. via Giorgio e Guido Paglia n. 1/D 24122 Bergamo, to the kind attention of the Privacy Officer, or via e-mail to the address privacy.hexagon@percassi.it data subjects can ask the controller to access the data concerning them, their cancellation, the correction of inaccurate data, the integration of incomplete data, the limitation of processing in the cases provided for by art. 18 GDPR, as well as the opposition to the processing in the hypothesis of legitimate interest of the owner.
	Data subjects also, in the case in which the processing is based on consent or contract and is carried out with automated tools, have the right to receive the data in an organised, commonly used, machine-readable and interoperable format, and, if technically possible, to transmit it to another controller without hindrance.
	Data subjects have the right to revoke the consent given at any time for marketing and/or profiling purposes, as well as to object to the processing of data for marketing purposes, including profiling connected to direct marketing. Data subjects who prefer to be contacted for the aforementioned purpose exclusively via traditional methods may express their objection solely for the reception of communications via automated systems.
	Data subjects have the right to lodge a complaint with a supervisory authority in the Member State of their habitual residence, place of work or place of the alleged infringement.