This notice is addressed to those who interact with the web services of the site https://www.sanmarinooutlet.com/ (hereinafter, the "Site").
This information does not concern other sites, pages, or online services accessible via hyperlinks that may be published on the Site but refer to resources external to the domain https://www.sanmarinooutlet.com/.
Processing is carried out in compliance with:
- EU Regulation 2016/679 (hereinafter the "Regulation");
- Law 171/2018 of the Republic of San Marino (hereinafter the "Law");
- the guidelines of the competent supervisory authorities.
1. Data Controller, Data Processor, and EU Representative
The Data Controller is, as owner of the San Marino Outlet (hereinafter "SMO"), the company THE MARKET PropCo Srl (hereinafter also "THE MARKET"), with registered office in Strada degli Angariari 41 – 47891 Falciano (RSM), C.O.E. 26567, in the person of its pro tempore legal representative, Email: privacy@themarket.sm.
The Data Controller has appointed a Data Protection Officer (DPO), reachable at dpo@themarket.sm or by writing to THE MARKET's registered office.
The Data Controller's EU Representative is the company Promos Development Srl, with registered office in Via San Zeno n. 173, 25124 – Brescia, tax code and VAT number 04444270989, in the person of its pro tempore legal representative, Email: rappresentanteUEsanmarinoutlet@gmail.com.
Finally, the Data Processor, responsible for commercial management, promotion, and user relations, is Promos S.r.l. – Tax Code/VAT No.: 03123920179 – Via San Zeno, 173 – 25124 Brescia (BS), Phone: +39 030 2422862 – Fax: +39 030 2422870, Email: privacy@promosgroup.it, with a permanent establishment in San Marino in Falciano, Strada degli Angariari 41.
The Data Processor has appointed a Data Protection Officer (DPO), reachable at dpo@promosgroup.it, or by writing to Promos S.r.l.'s registered office.
2. Processing Principles
In processing users' personal data, THE MARKET applies the principles of lawfulness, fairness, and transparency. Personal data will be collected for specified, explicit, and legitimate purposes (purpose limitation) and will be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed (data minimization). Data will always be kept up to date and accurate and stored for no longer than necessary for the Controller's purposes (storage limitation), after which it will be deleted. Finally, data will be processed adopting all security measures adequate to guarantee its integrity and inaccessibility by unauthorized third parties (integrity, confidentiality, and availability).
3. Data Processed
a) Data acquired during browsing
The computer systems and software procedures used to operate the Site acquire, during their normal operation, certain personal data whose transmission is implicit in the use of internet communication protocols.
This information is not collected for the purpose of being associated with identified individuals, but by its very nature could, through processing and association with data held by third parties, allow users to be identified. This category of data includes IP addresses or domain names of computers used by users connecting to the Site, URI (Uniform Resource Identifier) addresses of requested resources, the time of the request, the method used in submitting the request to the server, the size of the file obtained in response from the server (success, error, etc.), and other parameters relating to the users' operating system and computing environment. This data is used solely to derive anonymous statistical information about Site usage and to check its correct functioning. The data may also be used to establish liability in the event of hypothetical computer crimes against the Site.
b) Data voluntarily provided by users
THE MARKET also collects personal data voluntarily provided by users when interacting with the Site's services or filling out data collection forms — or when requesting the newsletter, participating in initiatives run on the Site, requesting information, or sending communications.
In the sections of the Site where users' personal data is collected, a link to this Privacy Policy or to other specific data processing notices is always present.
Where, in the course of using the Site's services, users provide personal data of third parties, they warrant that they have provided such third parties with this notice and have obtained their consent to the disclosure of their personal data, where necessary.
c) Cookies
Please refer to the Site's specific Cookie Policy for all information regarding the type and methods of use of cookies and similar tracking tools.
4. Purposes and Legal Basis of Processing
The data collected will be processed for the following purposes:
a) Browsing the website
PURPOSE: to allow users to browse the Site.
LEGAL BASIS: the need to carry out specific requests from data subjects and to perform contracts to which they are party.
NATURE OF PROVISION: necessary if the user wishes to browse the Site and use its services.
b) Newsletter and other marketing activities
PURPOSE: to allow users to subscribe to the newsletter and to other communications from the Controller regarding promotions, offers, initiatives, etc., via email, SMS, MMS, instant messaging or other means, as well as through traditional channels (phone calls via operator, paper mail).
LEGAL BASIS: users' consent. Once consent has been given, users may withdraw it or object at any time in order to stop receiving promotional communications. To object, it is sufficient to use the "Unsubscribe" option included in every email sent, or to contact the Controller.
NATURE OF PROVISION: consent to data processing for newsletter subscription and to receive other promotional communications from the Controller is optional. If consent is not given, it will still be possible to browse all sections of the site.
c) Data collection via the "Open Positions – Spontaneous Applications" form or other forms on the site
PURPOSE: data provided by submitting a CV or filling out forms on the site will be processed solely for personnel search and selection purposes and/or other San Marino Outlet contact purposes. For the "Open Positions – Spontaneous Applications" form, the complete notice will be provided during any interview with the candidate; in all other cases, further specific notices will be provided by THE MARKET to users where necessary.
LEGAL BASIS: performance of pre-contractual measures taken at the data subject's request, and the user's consent where applicable, in the case of CVs being shared with brands operating stores at the San Marino Outlet.
NATURE OF PROVISION: providing the data is necessary if the user intends to submit an application to the Company or to brands operating stores at the San Marino Outlet, and/or in any case to contact or take part in San Marino Outlet initiatives.
5. Methods and Duration of Processing
Users' personal data is collected and processed using electronic tools and, to a lesser extent, manual tools, and only for the time necessary to achieve the Controller's purposes. Processing logic and procedures are related to the purposes specified in this Privacy Policy. Depending on the specific processing purpose, personal data is accessible to authorized personnel and to data processors.
No processes based entirely on automated decision-making that produce legal effects for users or significantly affect them are used.
Users' personal data will be processed for the time necessary to manage their interaction with the Site and to ensure they can enjoy the related goods and/or services. Once these purposes have been fulfilled, the data is deleted unless it must be retained for the period required by law for administrative, accounting, and tax purposes, or to assert any contractual rights.
Data processed for newsletter sending and other marketing activities is processed until consent is withdrawn or the user objects.
6. Recipients of Personal Data
Personal data may be shared with third parties that carry out activities necessary for providing the services offered on the Site, who will process the data as data processors or as independent controllers. Specifically, the data will be processed by the following parties or categories of parties:
- commercial partners that provide IT services;
- service providers acting on the Controller's behalf under contractual agreements, for administrative, commercial, and advertising management of the San Marino Outlet;
- companies and consultants providing legal, accounting, and tax assistance and advice;
- providers of services for managing the information system and telecommunications networks, including email;
- competent authorities for fulfilling legal obligations;
- participating San Marino Outlet stores and food outlets.
Through the Social Network icons present on the Site, some user data may also be transmitted to Social Networks. Regarding this processing, which is carried out outside this Site, please refer to their specific privacy notices.
All the above parties are required to use the information received only for the processing purposes indicated above, to keep it confidential, intact, and unavailable to unauthorized third parties. Users' data is not disseminated.
7. Transfer of Personal Data
Some of users' personal data is shared with recipients that may be located outside the Republic of San Marino and the European Economic Area (EEA). The Controller ensures that the processing of personal data by these recipients complies with the Law and the Regulation and, in any case, adopts adequate safeguards. Such transfers may be based on an adequacy decision or on the Standard Contractual Clauses approved by the European Commission.
8. Rights of Data Subjects
Articles 15 to 22 of the Law and of the Regulation grant users, as data subjects, the exercise of specific rights. Article 15 grants users the right to access their personal data and obtain a copy of it. The right to obtain a copy of the data must not infringe the rights and freedoms of others.
With an access request, users have the right to obtain confirmation from the Controller as to whether or not processing of their personal data is underway, and to know the purposes and categories of data processed, the third parties to whom the data is disclosed, and whether the data is transferred to a non-European country with adequate safeguards. Users also have the right to know the retention period of their personal data in relation to the above purposes.
Regarding their personal data, users have the right to request rectification of inaccurate data and completion of incomplete data, erasure ("right to be forgotten") under the conditions set out in Art. 17, restriction of processing, and data portability.
The Controller will also provide users with confirmation that the operations resulting from the above requests have been communicated to those to whom the data may have been disclosed, except where this proves impossible or involves a disproportionate effort relative to the rights protected.
To exercise the above rights, it is necessary to contact:
- the Controller at the email address privacy@themarket.sm or the DPO at dpo@themarket.sm, or write to THE MARKET's registered office;
- the EU Representative at the email address rappresentanteUEsanmarinoutlet@gmail.com, or write to its registered office at Via San Zeno n. 173, 25124 – Brescia.
To provide a response, it may be necessary to identify users by requesting a copy of their ID document. The Controller will provide a written response without undue delay and, in any case, no later than one month from receipt of the request.
9. Complaint to the Data Protection Supervisory Authority
Users who believe that the processing of their personal data violates the provisions of the Law, the Regulation, or more generally applicable data protection legislation, have the right to lodge a complaint:
- if they reside or work in the territory of the Republic of San Marino, or if the violation occurred there, with the Data Protection Supervisory Authority (www.garanteprivacy.sm), as provided by Art. 66 of the Law, or to bring the matter before the competent courts (Art. 70 of the Law);
- if they reside or work in the territory of the European Union, or if the violation occurred there, with the Italian Data Protection Authority (www.gpdp.it), as provided by Art. 77 of the Regulation, or to bring the matter before the competent courts (Art. 79 of the Regulation).
10. Updates
This privacy policy may be subject to changes and/or additions following any subsequent regulatory changes and/or additions, updates or provision of new services, or technological innovations. Any changes will be published on the Site and, where applicable, notified to users via email.
Version March 19, 2026