Welcome to the website www.legami.com (the "Site").

We invite you to read our Privacy Policy, that it applies when you browse the website, independently from your decision to use the services and/or buy the products.

We also invite you to read the General Condition of the use of the website, because they also contain instructions on the privacy and security system adopted by the Site.

Privacy Notice to Users 

Triboo Digitale S.r.l. with registered office in Viale Sarca 336, Edificio 16, 20126 Milan, VAT no./Tax Code and listing number with the Milan Companies Register IT02387250307 (hereinafter also "Triboo") and Legami S.r.l. with registered office in 24126 Bergamo (BG), Via Federico Ozanam n. 2, 24126 Bergamo, Vat number and Tax Code no. 02937550164  (hereinafter, also "Legami" and, together with Triboo, in relation to the purposes described in the following paragraph no 1, the "Joint Controllers"), acting  as Joint Controllers of the processing of personal data of users (hereafter, the "Users") who browse and use the services available on the website www.legami.com (hereinafter, the "Website" and the "Services") provide below the privacy policy pursuant to art. 13 of EU Regulation 2016/679 of 27 April 2016 (hereinafter, "Regulations", or also the "Applicable Regulations").

This Website and the Services are reserved for individuals who are at least eighteen years of age.
The Joint Controllers therefore do not collect personal data relating to persons under 18 years of age. Upon requests by Users, the Joint Controllers will promptly delete all personal data involuntarily collected and related to subjects under 18 years of age. 

The Joint Controllers strictly adhere to the right to privacy and protection of the personal data of their Users.
For any information relating to this privacy policy, Users may contact the Joint Controllers at any time, using the following methods:

For Triboo:

• By sending a registered letter with return receipt to the registered office of the Data Controller Viale Sarca 336, Edificio 16, 20126 Milan;
• By sending an e-mail to the address privacy+legami@triboo.it

 For Legami:

• By sending a registered letter with return receipt to the registered office of the Data Controller in Via Ozanam n. 2, 24126 Bergamo
• By sending an e-mail to the address privacy@legami.com

• By sending a fax to no. +39 035 536973

Users can also contact

the Data Protection Officer (DPO) of:

Triboo, whose contact details are: e-mail lapo.curinigalletti@triboo.it.

Legami, whose contact details are: e-mail dpo@legami.com

1. Joint purposes of processing by Triboo and Legami acting as Joint Controllers

Users' personal data will be processed lawfully by the Joint Controllers pursuant to art. 6 of the Regulations for the following processing purposes:

a)     contractual obligations and provision of the Services, to allow browse of the Website or to implement the Terms of Use of the Website, which are accepted by the User during registration on the Site and/or during use of the Services and to fulfil specific User requests. The User's data collected by the Joint Controllers for the afore-mentioned purposes include: the name, surname, tax code and e-mail address, as well as any personal information of the User that may be voluntarily published. Unless the User provides Joint Controllers with specific and optional consent to the processing of their data for further purposes, the User's personal data will be used by Joint Controllers for the sole purpose of ascertaining the identity of the User (also through validation of the e-mail address), thus avoiding possible scams or abuses, and contacting the User only for reasons of service (e.g. to send notifications relating to the Services). Notwithstanding the provisions elsewhere in this privacy statement, under no circumstances will the Joint Controllers make the personal data of the Users accessible to other Users and/or to third parties.

b)     administrative-accounting purposes, that is to perform activities of an organizational, administrative, financial and accounting nature, such as internal organizational activities and functional activities for the fulfilment of contractual and pre-contractual obligations;

c)     legal obligations, that is to fulfil obligations imposed by law, by an authority, by a regulation or by European legislation.

The provision of personal data for the purposes of processing indicated above is optional but necessary, as failure to provide the same will make it impossible for the user to browse the Website, to register with Website or to use the Services.

The personal data that are necessary for the pursuit of the processing purposes described in this paragraph 1 are indicated with an asterisk in the Website registration form.

2. Purposes of processing by Legami S.r.l. as autonomous Data Controller

Legami S.r.l. will process personal data of the User for the following purposes:

a)        Evaluation of job applications, for the hypotheses in which the User uses the service “Work with us”, the processing will be necessary for the performance of a contract; Section 111-bis D.Lgs 196/2003 also applies.

b)       Maintenance, operation and security of IT system of Legami S.r.l.: this processing will be necessary for the legitimate interest of Data Controller and for the compliance with a legal obligation to which the Data Controller is subject.

c)        Shipment of the goods: the processing will be necessary for the performance of a contract.

The provision of data for purposes a) b) c) is mandatory to fulfil contractual provisions or legal provision and in order to carry out the business activity correctly. As a consequence of this, in lack of the provision of data, Legami will not be able to fulfil contractual or legal provisions and to carry out the business activity correctly.

d)       Sending newsletter: this processing consists of sending to the email address of the User commercial communications by Legami S.r.l., also by means of tools provided by third parties that use statistical tracking systems: this processing will take place after explicit consent of the User, to be understood as the basis of lawfulness of such processing, conferred at the time of the enrolment.

e)        Marketing operated through services of customer match (Google Ads) and customer audience (Facebook Ads); this processing will take place after explicit consent of the User, to be understood as basis of lawfulness of such processing, conferred at the time of the enrolment to the newsletter and it will involve the transmission of the personal data of the User to aforementioned service providers (Google and Facebook) to show you some advertisements.

The provision of the personal data for purposes d) e e) is merely optional and, in lack of such data provision, the data subject will have no consequences.

3. Processing methods and data retention times

The Joint Controllers will process the personal data of the Users using manual and IT tools, with logic strictly related to the purposes themselves and, in any case, in order to guarantee the security and confidentiality of the data. 

Users' personal data will be kept:

• for the purposes described in paragraph 1 above, for the time strictly necessary to perform them or, in any case, as necessary for the protection in civil law of the interests of both Users and of Joint Controllers;
• for the purposes described in paragraph 2 above, the personal data of Users will be kept with different timing depending on the specific purpose:

a)        Evaluation of job application: maximum 2 years from receipt of the application.

b)       Maintenance, operation and security of IT system of Legami S.r.l.: for the time strictly necessary for carrying out the maintenance.

c)        Shipment of the goods: 10 years from the termination of contractual relationship.

d)       Sending newsletter: up to the withdrawal of consent.

e)        Marketing: up to withdrawal of consent.

4. Scope of communication and dissemination of data

The personal data of Users may be disclosed to the employees and/or collaborators of the Joint Controllers in charge of managing the Website and all the services related to the provision of the Services. These subjects, who have been instructed to do so by the Joint Controllers pursuant to Article 29 of the Regulations, will process the Users' data exclusively for the purposes indicated in this statement and in compliance with the provisions of the Applicable Law.

Personal data of the Users may also be disclosed to third parties who may process personal data on behalf of the Joint Controllers as "External Processors", such as,

• For Triboo: by way of example, suppliers of IT and logistics services functional to the operation of the Website. and/or Services, service providers of outsourcing or cloud computing, professionals and consultants;
• For Legami S.r.l.: IT service providers, IT consultants, delivery companies, providers of tools for sending newsletter, providers of marketing services.

Users have the right to obtain a list of any data controllers appointed by each Data Controller respectively, making a request to the Data Controller in the manner indicated in paragraph 5 below.

Furthermore, the personal data of Users may be disclosed by the Joint Controllers, to the extent that this is necessary and essential for the implementation of contractual obligations, to third parties who are independent data controllers, such as providers of the services payment and of logistics services necessary for delivery of goods sold through the Website.

These autonomous controllers will process the User's data exclusively for the purpose of correct fulfilment of the orders relating to the Services.

5. Rights of Interested Parties

Users may exercise their rights granted by the Applicable Regulations by contacting the Joint Controllers in the following ways:

• By sending a registered letter with return receipt to the registered office of the Joint Controllers:

for Triboo: Milan (MI) Viale Sarca, 336 Postal Code 20126

for Legami: Bergamo (BG) Via Ozanam n. 2, Postal Code 24126

• By sending an e-mail to the address

for Triboo: privacy+legami@triboo.it

for Legami: privacy@legami.com

• By sending a fax to number

for Triboo: +39 02 64741490

for Legami: +39 035 536973

Jointly, Triboo and Legami will comply with the requests of Users relating to the processing referred to in paragraph 1, while Legami will comply with the requests of Users relating to the processing referred to in paragraph 2.

Pursuant to the Applicable Regulations, the Joint Controllers inform Users that they have the right to obtain an indication (i) of the origin of personal data; (ii) of the purposes and methods of the processing; (iii) of the logic applied in the event of processing carried out with the aid of electronic instruments; (iv) of the identification details of the Joint Controllers and Data Processors; (v) of the subjects or categories of subjects to whom the personal data may be communicated or who may learn of it as data processors or officers.

 Furthermore, Users have the right to obtain: 

a) access, updating, rectification or, when of relevant, the integration of data; 

b) the cancellation, transformation into anonymous form or blocking of data processed unlawfully, including data whose retention is unnecessary for the purposes for which the data was collected or subsequently processed;

 c) the attestation that the operations referred to in letters a) and b) have been brought to the attention, also with regard to its content, of those persons to whom the data has been communicated or disseminated, except in the case where such fulfilment proves impossible or involves the use of means manifestly disproportionate to the protected right.

Furthermore, Users have:

a) the right to withdraw consent at any time, if the processing is based on their consent;

b) (where applicable) the right to the portability of data (the right to receive all personal data concerning them in a structured format, commonly used and readable by automatic device), the right to limit the processing of personal data and the right to its deletion ("right to be forgotten");

c) the right to oppose: 

i) in whole or in part, for legitimate reasons, the processing of personal data concerning them, even if pertinent to the purpose of the collection; 

ii) in whole or in part, to the processing of personal data concerning them for the purpose of sending advertising or direct sales material or for carrying out market research or commercial communication; 

iii) if personal data is processed for direct marketing purposes, at any time, to the processing of their data for this purpose, including profiling in so far as it is related to such direct marketing.

d) if they believe that the processing that concerns them violates the Regulation, the right to lodge a complaint with a Supervisory Authority (in the Member State in which they usually reside, in the one in which they work or in the one in which the alleged violation has occurred). The Italian Supervisory Authority is the Guarantor for the protection of personal data, located in Piazza Venezia n. 11 – 00187 Roma (http://www.garanteprivacy.it/).

The Joint Controllers are not responsible for the updating of all links that can be viewed in this Policy, therefore whenever a link is not functional and/or updated, Users acknowledge and accept that they must always refer to the document and/or section of the websites referred to by this link. 

PRIVACY POLICY

Welcome to the website www.legami.com (the "Site").

We invite you to read our Privacy Policy, that it applies when you browse the website, independently from your decision to use the services and/or buy the products.

We also invite you to read the General Condition of the use of the website, because they also contain instructions on the privacy and security system adopted by the Site.

Privacy Notice to Users 

Triboo Digitale S.r.l. with registered office in Viale Sarca 336, Edificio 16, 20126 Milan, VAT no./Tax Code and listing number with the Milan Companies Register IT02387250307 (hereinafter also "Triboo") and Legami S.r.l. with registered office in 24126 Bergamo (BG), Via Federico Ozanam n. 2, 24126 Bergamo, Vat number and Tax Code no. 02937550164  (hereinafter, also "Legami" and, together with Triboo, in relation to the purposes described in the following paragraph no 1, the "Joint Controllers"), acting  as Joint Controllers of the processing of personal data of users (hereafter, the "Users") who browse and use the services available on the website www.legami.com (hereinafter, the "Website" and the "Services") provide below the privacy policy pursuant to art. 13 of EU Regulation 2016/679 of 27 April 2016 (hereinafter, "Regulations", or also the "Applicable Regulations").

This Website and the Services are reserved for individuals who are at least eighteen years of age.
The Joint Controllers therefore do not collect personal data relating to persons under 18 years of age. Upon requests by Users, the Joint Controllers will promptly delete all personal data involuntarily collected and related to subjects under 18 years of age. 

The Joint Controllers strictly adhere to the right to privacy and protection of the personal data of their Users.
For any information relating to this privacy policy, Users may contact the Joint Controllers at any time, using the following methods:

For Triboo:

• By sending a registered letter with return receipt to the registered office of the Data Controller Viale Sarca 336, Edificio 16, 20126 Milan;
• By sending an e-mail to the address privacy+legami@triboo.it

 For Legami:

• By sending a registered letter with return receipt to the registered office of the Data Controller in Via Ozanam n. 2, 24126 Bergamo
• By sending an e-mail to the address privacy@legami.com

• By sending a fax to no. +39 035 536973

Users can also contact

the Data Protection Officer (DPO) of:

Triboo, whose contact details are: e-mail lapo.curinigalletti@triboo.it.

Legami, whose contact details are: e-mail dpo@legami.com

1. Joint purposes of processing by Triboo and Legami acting as Joint Controllers

Users' personal data will be processed lawfully by the Joint Controllers pursuant to art. 6 of the Regulations for the following processing purposes:

a)     contractual obligations and provision of the Services, to allow browse of the Website or to implement the Terms of Use of the Website, which are accepted by the User during registration on the Site and/or during use of the Services and to fulfil specific User requests. The User's data collected by the Joint Controllers for the afore-mentioned purposes include: the name, surname, tax code and e-mail address, as well as any personal information of the User that may be voluntarily published. Unless the User provides Joint Controllers with specific and optional consent to the processing of their data for further purposes, the User's personal data will be used by Joint Controllers for the sole purpose of ascertaining the identity of the User (also through validation of the e-mail address), thus avoiding possible scams or abuses, and contacting the User only for reasons of service (e.g. to send notifications relating to the Services). Notwithstanding the provisions elsewhere in this privacy statement, under no circumstances will the Joint Controllers make the personal data of the Users accessible to other Users and/or to third parties.

b)     administrative-accounting purposes, that is to perform activities of an organizational, administrative, financial and accounting nature, such as internal organizational activities and functional activities for the fulfilment of contractual and pre-contractual obligations;

c)     legal obligations, that is to fulfil obligations imposed by law, by an authority, by a regulation or by European legislation.

The provision of personal data for the purposes of processing indicated above is optional but necessary, as failure to provide the same will make it impossible for the user to browse the Website, to register with Website or to use the Services.

The personal data that are necessary for the pursuit of the processing purposes described in this paragraph 1 are indicated with an asterisk in the Website registration form.

2. Purposes of processing by Legami S.r.l. as autonomous Data Controller

Legami S.r.l. will process personal data of the User for the following purposes:

a)        Evaluation of job applications, for the hypotheses in which the User uses the service “Work with us”, the processing will be necessary for the performance of a contract; Section 111-bis D.Lgs 196/2003 also applies.

b)       Maintenance, operation and security of IT system of Legami S.r.l.: this processing will be necessary for the legitimate interest of Data Controller and for the compliance with a legal obligation to which the Data Controller is subject.

c)        Shipment of the goods: the processing will be necessary for the performance of a contract.

The provision of data for purposes a) b) c) is mandatory to fulfil contractual provisions or legal provision and in order to carry out the business activity correctly. As a consequence of this, in lack of the provision of data, Legami will not be able to fulfil contractual or legal provisions and to carry out the business activity correctly.

d)       Sending newsletter: this processing consists of sending to the email address of the User commercial communications by Legami S.r.l., also by means of tools provided by third parties that use statistical tracking systems: this processing will take place after explicit consent of the User, to be understood as the basis of lawfulness of such processing, conferred at the time of the enrolment.

e)        Marketing operated through services of customer match (Google Ads) and customer audience (Facebook Ads); this processing will take place after explicit consent of the User, to be understood as basis of lawfulness of such processing, conferred at the time of the enrolment to the newsletter and it will involve the transmission of the personal data of the User to aforementioned service providers (Google and Facebook) to show you some advertisements.

The provision of the personal data for purposes d) e e) is merely optional and, in lack of such data provision, the data subject will have no consequences.

3. Processing methods and data retention times

The Joint Controllers will process the personal data of the Users using manual and IT tools, with logic strictly related to the purposes themselves and, in any case, in order to guarantee the security and confidentiality of the data. 

Users' personal data will be kept:

• for the purposes described in paragraph 1 above, for the time strictly necessary to perform them or, in any case, as necessary for the protection in civil law of the interests of both Users and of Joint Controllers;
• for the purposes described in paragraph 2 above, the personal data of Users will be kept with different timing depending on the specific purpose:

a)        Evaluation of job application: maximum 2 years from receipt of the application.

b)       Maintenance, operation and security of IT system of Legami S.r.l.: for the time strictly necessary for carrying out the maintenance.

c)        Shipment of the goods: 10 years from the termination of contractual relationship.

d)       Sending newsletter: up to the withdrawal of consent.

e)        Marketing: up to withdrawal of consent.

4. Scope of communication and dissemination of data

The personal data of Users may be disclosed to the employees and/or collaborators of the Joint Controllers in charge of managing the Website and all the services related to the provision of the Services. These subjects, who have been instructed to do so by the Joint Controllers pursuant to Article 29 of the Regulations, will process the Users' data exclusively for the purposes indicated in this statement and in compliance with the provisions of the Applicable Law.

Personal data of the Users may also be disclosed to third parties who may process personal data on behalf of the Joint Controllers as "External Processors", such as,

• For Triboo: by way of example, suppliers of IT and logistics services functional to the operation of the Website. and/or Services, service providers of outsourcing or cloud computing, professionals and consultants;
• For Legami S.r.l.: IT service providers, IT consultants, delivery companies, providers of tools for sending newsletter, providers of marketing services.

Users have the right to obtain a list of any data controllers appointed by each Data Controller respectively, making a request to the Data Controller in the manner indicated in paragraph 5 below.

Furthermore, the personal data of Users may be disclosed by the Joint Controllers, to the extent that this is necessary and essential for the implementation of contractual obligations, to third parties who are independent data controllers, such as providers of the services payment and of logistics services necessary for delivery of goods sold through the Website.

These autonomous controllers will process the User's data exclusively for the purpose of correct fulfilment of the orders relating to the Services.

5. Rights of Interested Parties

Users may exercise their rights granted by the Applicable Regulations by contacting the Joint Controllers in the following ways:

• By sending a registered letter with return receipt to the registered office of the Joint Controllers:

for Triboo: Milan (MI) Viale Sarca, 336 Postal Code 20126

for Legami: Bergamo (BG) Via Ozanam n. 2, Postal Code 24126

• By sending an e-mail to the address

for Triboo: privacy+legami@triboo.it

for Legami: privacy@legami.com

• By sending a fax to number

for Triboo: +39 02 64741490

for Legami: +39 035 536973

Jointly, Triboo and Legami will comply with the requests of Users relating to the processing referred to in paragraph 1, while Legami will comply with the requests of Users relating to the processing referred to in paragraph 2.

Pursuant to the Applicable Regulations, the Joint Controllers inform Users that they have the right to obtain an indication (i) of the origin of personal data; (ii) of the purposes and methods of the processing; (iii) of the logic applied in the event of processing carried out with the aid of electronic instruments; (iv) of the identification details of the Joint Controllers and Data Processors; (v) of the subjects or categories of subjects to whom the personal data may be communicated or who may learn of it as data processors or officers.

 Furthermore, Users have the right to obtain: 

a) access, updating, rectification or, when of relevant, the integration of data; 

b) the cancellation, transformation into anonymous form or blocking of data processed unlawfully, including data whose retention is unnecessary for the purposes for which the data was collected or subsequently processed;

 c) the attestation that the operations referred to in letters a) and b) have been brought to the attention, also with regard to its content, of those persons to whom the data has been communicated or disseminated, except in the case where such fulfilment proves impossible or involves the use of means manifestly disproportionate to the protected right.

Furthermore, Users have:

a) the right to withdraw consent at any time, if the processing is based on their consent;

b) (where applicable) the right to the portability of data (the right to receive all personal data concerning them in a structured format, commonly used and readable by automatic device), the right to limit the processing of personal data and the right to its deletion ("right to be forgotten");

c) the right to oppose: 

i) in whole or in part, for legitimate reasons, the processing of personal data concerning them, even if pertinent to the purpose of the collection; 

ii) in whole or in part, to the processing of personal data concerning them for the purpose of sending advertising or direct sales material or for carrying out market research or commercial communication; 

iii) if personal data is processed for direct marketing purposes, at any time, to the processing of their data for this purpose, including profiling in so far as it is related to such direct marketing.

d) if they believe that the processing that concerns them violates the Regulation, the right to lodge a complaint with a Supervisory Authority (in the Member State in which they usually reside, in the one in which they work or in the one in which the alleged violation has occurred). The Italian Supervisory Authority is the Guarantor for the protection of personal data, located in Piazza Venezia n. 11 – 00187 Roma (http://www.garanteprivacy.it/).

The Joint Controllers are not responsible for the updating of all links that can be viewed in this Policy, therefore whenever a link is not functional and/or updated, Users acknowledge and accept that they must always refer to the document and/or section of the websites referred to by this link.