Our privacy practices comply with applicable laws at the national level (Legislative Decree No. 196 of June 30, 2003) and at the EU level (EU Regulation 2016/679) regarding the protection of personal data.

SANUSLIFE explains on this page how it processes the data of users who visit its website and how the cookies installed on this website function.

This privacy policy is provided in accordance with Article 13 of the GDPR 2016/679 (General Data Protection Regulation of the European Union, which harmonizes the rules for the processing of personal data), Recommendation No. 2/2001 of the Working Party pursuant to Article 29, and the general provision of the Data Protection Authority on cookies No. 229 of May 8, 2014.

The following information applies to this website and all directly connected subdomains. The data controller is not responsible for data and cookies inserted or installed by third-party websites that may be accessed via links.

Data Controller Information

The data controller is SANUSLIFE, with its registered office at Lindenstrasse 8, CH-6340 Baar. To exercise the rights provided by law, you may contact the data controller at its administrative office, by phone at +41 041 510 93 03, or in writing at [email protected].

Purpose and Legal Basis of Data Processing

SANUSLIFE processes the data entered by the user for the following purposes:

a. Requests for information, responses to contact inquiries, or support requests

Providing the requested data is necessary in order to process your inquiry. The legal basis for processing is, in accordance with Article 6(1)(b) of the GDPR, the performance of a contract to which the data subject is party or the implementation of pre-contractual measures taken at the data subject’s request, as well as, in accordance with Article 6(1)(f), processing for the purposes of the legitimate interests pursued by the controller or a third party. The data processed in response to your inquiry will be retained for a period of six months.

b. Registration and Use of the Platform (FREE User)

The submission of the requested data is essential in order to create your account and thereby grant you access to our platform and the use of our services (these include, for example, access to our online community SANUSWORLD, the use of SANUSAPP services, as well as services related to SANUSLIFE Marketplace and SANUSLIFE Finance). Furthermore, we require the data for processing related to the services (collecting SANUSCREDITS, using and accepting SANUSCOINS, participating in events organized by SANUSLIFE, attending courses offered by SANUSACADEMY, etc.). As a registered user, you are also authorized to invite other individuals to register on the SANUSLIFE platform and use the services. The legal basis for the processing is, in accordance with Art. 6 para. 1 lit. b) GDPR, the performance of a contract to which the data subject is party, or the implementation of pre-contractual measures taken at the request of the data subject. The data processed in connection with the registration will be retained until you submit a request for deletion and deregistration.

c. Entering into a Business Relationship/Partnership (COMPANY Partner)

The submission of the requested data is essential in order to review your request to enter into a business relationship (partnership) and, if the review is positive, to subsequently grant you the opportunity to promote or market your products via the SANUSLIFE platform (for example, by becoming a COMPANY Partner / NON-PROFIT Partner). Entering into such a partnership means that SANUSLIFE will process data related to the purchases and sales of the business partner both for the purpose of fulfilling accounting, tax, and legal obligations, as well as for all purposes related to the execution of the business relationship. The legal basis for the processing is, in accordance with Art. 6 para. 1 lit. b) GDPR, the performance of a contract to which the data subject is party, or the implementation of pre-contractual measures taken at the request of the data subject. The data processed in connection with the registration will be retained until the termination of the business relationship.

d. Fulfillment of Obligations Arising from a Law, Regulation, or Union Provision

The provision of data for this purpose is mandatory, and the legal basis is the fulfillment of a legal obligation to which the controller is subject, as provided in Art. 6 para. 1 lit. c) GDPR. For processing carried out for this purpose, the user's consent is not required. Considering the fact that every user of SANUSLIFE services can accumulate, use, and accept SANUSCREDIT and SANUSCOIN, data processing also includes those processes triggered by such transactions. The data processed in this context will be retained for the period specified by the relevant legal provisions.

e. Statistical Analyses of Aggregated or Anonymized Data

This type of processing does not allow for the identification of the user and serves exclusively to evaluate the effectiveness of web marketing campaigns or to verify the proper functioning of the site by monitoring access frequency. The processing of aggregated or anonymized data that does not allow user identification is not subject to data protection regulations, and therefore no consent is required for such processing.

f. Newsletter and Business Communications (FREE User)

Providing the requested data for subscribing to our newsletter service or for receiving promotional communications or advertising material is voluntary, and the legal basis for the related data processing is the consent of the data subject. The data processed for advertising and marketing purposes will be retained by us until the consent is withdrawn, unless the consent is renewed. Exempt from the requirement of obtaining voluntary and specific consent are those communications through which users are informed about actions and news on the virtual bulletin board accessible via the reserved area.

Processing Methods, Automated Decision-Making, and Data Retention Periods

Your data will be processed electronically, although potential processing in paper form is not excluded. Automated decision-making processes are not used for the processing of your personal data. The data collected through cookies will be stored for the periods specified by each individual cookie.

Disclosure of Data (Recipients)

To ensure the functionality of our website and the proper provision of content, we may use the services of third parties. These include, for example, IT service providers, hosting providers, telecommunications companies, external legal or tax advisors, transport companies, authorities and other public institutions, business partners (COMPANY Partner / NON-PROFIT Partner), service providers in the field of cryptocurrencies, etc. We would also like to inform you that – in addition to the persons and institutions already mentioned – users who are in your upline (this refers to the chain of distribution partners who enabled your registration and, for example, that of the partner directly above you) can view the profiles of users directly connected to them. Furthermore, we may use third-party services (e.g. freight carriers) to fulfill the requested services, such as in connection with the purchase of products. The legal basis for the transfer is the fulfillment of legal and contractual obligations as well as the implementation of pre-contractual measures based on your request. In any case, only the data necessary for the fulfillment of the respective service will be disclosed. If the transmission of anonymized data is sufficient, only such data will be transmitted. Your personal data will only be disclosed with your explicit consent. You have the right to contact SANUSLIFE at any time to request a list of external persons and institutions who have access to and process your data.

Regarding the use of third-party cookies, please refer to the section included at the end of this document.

Transfer of Data to Third Countries and International Organizations

The data you provide will not be transferred to third countries or to international organizations outside the European Union. However, since this is an online platform, the data may be accessible from any country in the world. The website is hosted within the European Union.

Rights of the Data Subject and Complaint to the Data Protection Authority

You have the right to exercise the rights granted to data subjects at any time, as listed below. To do so, please contact the controller (SANUSLIFE) using the contact details provided above. We will provide you with a written response within 30 days. Furthermore, if you believe that your data has been processed unlawfully, you may file a complaint with the competent supervisory authority, the Italian Data Protection Authority (Garante per la Protezione dei dati Personali) based in Rome, Italy.

I. Right of Access by the Data Subject

1. The data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning them is being processed; if this is the case, they have the right to access such personal data and the following information:

a) the purposes of the processing;

b) the categories of personal data that are being processed;

c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations;

d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;

e) the existence of the right to request from the controller rectification or erasure of personal data concerning them or restriction of processing, or to object to such processing;

f) the existence of the right to lodge a complaint with a supervisory authority;

g) where the personal data are not collected from the data subject, any available information as to their source;

h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) of the GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

2. Where personal data are transferred to a third country or to an international organization, the data subject has the right to be informed of the appropriate safeguards pursuant to Article 46 relating to the transfer.

3. The controller shall provide a copy of the personal data undergoing processing.

For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs.

If the data subject makes the request by electronic means, the information shall be provided in a commonly used electronic format, unless otherwise requested.

4. The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others.

II. Right to Rectification

1. The data subject has the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning them.

2. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement.

III. Right to Erasure

1. The data subject has the right to obtain from the controller the erasure of personal data concerning them without undue delay, and the controller is obliged to erase personal data without undue delay where one of the following grounds applies:

a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

b) the data subject withdraws consent on which the processing is based according to Article 6(1)(a) or Article 9(2)(a), and there is no other legal ground for the processing;

c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);

d) the personal data have been unlawfully processed;

e) the erasure of the personal data is required for compliance with a legal obligation under Union or Member State law to which the controller is subject;

f) the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).

2. Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copies or replications of, those personal data.

3. Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:

a) for exercising the right of freedom of expression and information;

b) for compliance with a legal obligation which requires processing under Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

c) for reasons of public interest in the area of public health in accordance with Article 9(2)(h) and (i) as well as Article 9(3);

d) for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes in accordance with Article 89(1), insofar as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or

e) for the establishment, exercise, or defense of legal claims.

IV. Right to Restriction of Processing

1. The data subject has the right to obtain from the controller restriction of processing where one of the following conditions applies:

a) the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;

b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;

c) the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise, or defense of legal claims; or

d) the data subject has objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject.

2. Where processing has been restricted under paragraph 1, such personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise, or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

3. A data subject who has obtained restriction of processing pursuant to paragraph 1 shall be informed by the controller before the restriction is lifted.

V. Right to Data Portability

1. The data subject has the right to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used, and machine-readable format, and has the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where the processing

a) is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a), or on a contract pursuant to Article 6(1)(b); and

b) he processing is carried out by automated means.

2. In exercising their right to data portability pursuant to paragraph 1, the data subject has the right to have the personal data transmitted directly from one controller to another, where technically feasible.

3. The exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to Article 17. This right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

4. The right referred to in paragraph 1 shall not adversely affect the rights and freedoms of others.

VI. Right to Object

1. The data subject has the right to object, on grounds relating to their particular situation, at any time to the processing of personal data concerning them which is based on Article 6(1)(e) or (f), including profiling based on those provisions. The controller shall no longer process the personal data unless they can demonstrate compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims.

2. Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning them for such marketing, which includes profiling to the extent that it is related to such direct marketing.

3. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

4. At the latest at the time of the first communication with the data subject, the right referred to in paragraphs 1 and 2 shall be explicitly brought to their attention and shall be presented clearly and separately from any other information.

5. In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise their right to object by automated means using technical specifications.

6. Where personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1), the data subject shall, on grounds relating to their particular situation, have the right to object to processing of personal data concerning them, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

VII. Automated Individual Decision-Making, Including Profiling

1. The data subject shall have the right not to be subject to a decision based solely on automated processing — including profiling — which produces legal effects concerning them or similarly significantly affects them.

2. Paragraph 1 shall not apply if the decision:

a) is necessary for entering into, or the performance of, a contract between the data subject and the controller;

b) is authorized by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests; or

c) is based on the data subject’s explicit consent.

3. In the cases referred to in paragraph 2 points (a) and (c), the controller shall implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express their point of view, and to contest the decision.

4. Decisions referred to in paragraph 2 shall not be based on special categories of personal data referred to in Article 9(1), unless Article 9(2)(a) or (g) applies and appropriate measures have been taken to safeguard the rights and freedoms and legitimate interests of the data subject.

VIII. Sharing of Information

You hereby authorize us to share information about you, your account, and your account activities with law enforcement authorities, regulatory bodies, and government agencies. We also authorize you to share information about us and our acceptance services with law enforcement authorities, regulatory bodies, and government agencies.

COOKIES OF OUR WEBSITE

Navigation data

This website implicitly collects certain personal data of users who access the website through the use of internet communication protocols during its normal operation, such as IP address, domain names of the computers used by users to access the website, MAC addresses assigned by the manufacturers of network cards, Wi-Fi, etc.

This information is not collected with the intention of identifying users, although identification could be possible through associations and cross-processing with data from third parties. These data are used to generate statistical information about the use and functionality of the website, as well as additional information for determining liability in cases of cybercrime.

What are cookies?

Cookies are small text files that websites visited by the user store on the user's device. These data records are sent back to the website that stored them when the user visits again. If the user also receives cookies from other websites or web servers while navigating the site, these are referred to as third-party cookies.

Cookies are stored for various reasons. These include enabling IT authentications, monitoring navigation sessions, or selecting the language.

First- and third-party cookies

The cookies that are set directly by SANUSLIFE are called "first-party cookies." In contrast, cookies that are set and collected by a website other than the one the user is currently visiting are referred to as "third-party cookies."

Third-party cookies include social buttons (or social plug-ins) that allow the website to interact with popular social media platforms such as Facebook, Instagram, LinkedIn, Twitter, etc., as well as Google Analytics cookies and those required to implement YouTube frames, among others. Regarding third-party cookies, the third parties to whom these cookies belong are responsible for providing the privacy notice and information on how the collected data is managed.

Types of cookies

Technical cookies

Technical cookies are usually installed directly by the website operator and enable communication between the website and the user. These may include navigation or session cookies, which ensure the normal browsing and use of the website. They are typically stored for the duration of the user's session on the website. Additionally, there are functionality cookies that enhance the user experience, such as those used to select the website's language, add selected items to the shopping cart, and so on.

Since these cookies are essential for the website to function properly, no prior consent is required for them to be stored on the user's device.

Analytics cookies

These are cookies that can be used to collect information about users in more or less aggregated form, such as the number of users visiting the website or how the website is accessed. One of the most well-known tools for generating these statistical reports is Google Analytics, a service provided by Google Inc.

Analytics cookies can be considered equivalent to technical cookies if the information is collected in aggregated form and there is no way to identify the habits of individual users. Specifically regarding Google Analytics cookies, it is at least partially necessary to anonymize the IP address of the user visiting the website and to prevent data sharing by Google. If such anonymization and prevention of data sharing are not possible, these cookies are classified as profiling cookies.

Profiling cookies

These cookies are used to record a user's preferences and deliver advertising messages based on the insights gained. These cookies are particularly invasive, and the user's consent must be obtained before they are stored on the user's device.

Banner on first access

According to the provision of the Data Protection Authority dated May 8, 2014, when cookies other than technical cookies are used, a banner (known as a short notice) must be displayed upon the user's first access to the website. This banner must briefly explain how the website uses cookies and include a link to the extended privacy policy.

SANUSLIFE has implemented the aforementioned banner. When the user clicks the "Accept" button, they consent to the use of cookies and can continue using the website. Additionally, a specific cookie has been set up to store the user's choice regarding the installation of cookies. This means the user will only see the banner once. If they wish to change their choice at a later time, they must follow the instructions under "Instructions for disabling cookies".