EXTENDED INFORMATION ACCORDING TO ARTICLES 12, 13 AND, IF NECESSARY, 14 OF THE GDPR – REGULATION (EU) 2016/679 REGARDING THE PROTECTION OF NATURAL PERSONS, WITH REGARD TO THE PROCESSING OF PERSONAL DATA (HEREINAFTER GDPR)
The data controller discloses the information below pursuant to arts. 12, 13 and, if necessary, 14 of the GDPR relating to the processing of personal data provided by the customer/data subject by completing and signing the Contract for the purchase of products/services offered for sale by the data controller, spontaneously uploading data on this website personal data (especially by filling in forms) or by simply browsing it.
- Data controller and contact details
- Principles applicable to the processing
In accordance with the GDPR provisions, the data controller constantly endeavors to ensure that personal data are: processed lawfully, correctly and transparently; collected for specified, explicit and legitimate purposes, and subsequently processed in ways that are not incompatible with those purposes; adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed; exact and, if necessary, updated; kept for a period of time not exceeding the achievement of the purposes for which they are processed; treated, by means of appropriate technical and organizational measures, so as to guarantee their security; processed, if by consent, after a decision freely taken by the customer/data subject, on the basis of a request presented in a manner that is clearly distinguishable from the rest, in an understandable and easily accessible form, using a simple and clear language.
The data controller shall take appropriate technical and organizational measures in order to ensure the protection of personal data from the design stage and to ensure that, by default, only the data necessary for each specific processing purpose are processed.
The data controller collects and takes into the utmost consideration indications, observations and opinions of the Customer/data subject transmitted to the above-mentioned contact details, in order to implement a dynamic privacy management system that ensures effective protection of people, with regard to the processing of their data.
- Data processing methods
Data processing is implemented manually and electronically, with logics that are strictly related to the purposes mentioned below and, in any case, with the aim of guaranteeing the security and confidentiality of the same data.
- Purposes of the processing of personal data
(4a) Purposes for which the processing of data is necessary Personal data provided by the Customer/data subject are mainly processed for the execution of the Contract and the management of the credit and, more generally, of the relationship emerging from the Contract itself.
The provision of data in the Contract or later, during the contractual relationship, for the purposes of processing in question is mandatory; therefore, the failure, partial or incorrect conferment of such data makes it impossible to stipulate and/or execute the Contract and, for the customer/data subject, to take advantage of the products/services offered by the data controller, potentially exposing the Customer/data subject to liability for breach of contract.
The personal data provided by the Customer/data subject may also be processed, if this is necessary, to fulfill a legal obligation to which the data controller is subject, to safeguard the vital interests of the Customer/data subject or another natural person, for the execution of a task of public interest or connected to the exercise of public authority vested in the data controller, or for the pursuit of the legitimate interest of the data controller or of third parties, provided that they do not prevail the interests or rights and fundamental freedoms of the Customer/data subject; even in these cases, the provision of data is mandatory and, therefore, the failure, partial or incorrect communication of the data may expose the customer/data subject to any liability and penalties provided for by the legal order.
(4b) Further processing purposes as a result of specific and express consent of the Customer/data subjectIn addition to the processing purposes mentioned above, personal data provided/acquired can be processed, after Customer’s/data subject’s consent, which can be expressed by selecting the check box on the contract or on the site (or using other social apps or web data controller), also for conducting market research and for commercial and promotional communications, via phone (even using the mobile phone number provided) and automated contact systems (email, sms, mms, fax, etc.), on products/services of the data controller or of the group companies to which the Data controller possibly belongs.
The consent for the processing purposes referred to in this point (4b) is optional; therefore, as a result of any refusal, the data will be processed only for the purposes indicated in the previous point (4a), except for what is specified below with reference to the legitimate interests of the data controller or third parties.
- Categories of personal data processed
The data controller mainly deals with identification/contact data (name, surname, addresses, type and number of identification documents, telephone numbers, e-mail addresses, of a fiscal / invoicing nature, except for others) and, if commercial transactions are envisaged, financial data (of a banking nature, in particular identifying bank accounts, credit card numbers, except for others connected to the aforementioned commercial transactions).
The processing that the data controller performs, both for the execution of the Contract and after the express consent of the Customer/data subject, does not generally cover particular categories of personal data, known as sensitive (revealing the racial or ethnic origin, political opinions, religious beliefs, state of health or sexual orientation, etc.), genetic and biometric data or the so-called judicial data (relating to criminal convictions and crimes).
However, it cannot be excluded that the data controller, in order to perform the obligations deriving from the Contract, must preserve and/or need to process sensitive, genetic and biometric or judicial data of the Customer/data subject or third parties, that belong to the Customer/data subject, in his/her quality of data controller; in consideration of the above, the processing by the data controller is carried out under the conditions in force and within the limits set by the same data controller responsible for the processing, by the Customer/data subject.
The data controller processes, as data controller with reference to the Website, and, potentially, as Data processor entrusted with it (in the terms referred to above) by the Customer/data subject, also the so-called navigation data. During their normal operation, the computer systems and software procedures implemented for the operation of this Site acquire certain personal data whose transmission is implicit in the use of internet communication protocols. This information is not collected to be associated with identified persons, but which, by their very nature, might allow the data subject to be identified. This category of information includes geolocation data, IP addresses, type of browser, operating system, domain name and website addresses that were accessed or output, information on pages visited by users within the site, access time, permanence on the single page, internal path analysis and other parameters related to the operating system and the user’s computer environment. This information by its very nature might lead to the identification of users through processing and association with data held by third parties.
Session cookies (which are not stored on the user’s computer and disappear when closing the browser) and persistent ones, for the transmission of personal information, or in any case systems for the tracking of the data subjects may be used on the site.
- Source of personal data
The personal data that the data controller processes are collected directly by the same data controller from the customer/data subject at the time of, and when s/he browses on the Website (or using other social or web applications of the data controller), or even through his/her own sales agents, on or after signing the Contract, during the execution of the same, or from public sources.
As specified above, the data controller, in charge of the processing entrusted, in order to execute the obligations deriving from the Contract, may store and/or process data which are in particular navigation, potentially sensitive, genetic and biometric or judicial, third parties’ data, which the Customer/data subject possesses, as data controller, acquired, with the consent of said third parties, at the time of, and during the navigation of the same third parties on the Site (or using other social or web applications related to the data controller).
The legitimate interests of the data controller or third parties may constitute a valid legal basis for processing, provided that the interests or rights and fundamental freedoms of the data subject do not prevail. In general, such legitimate interests may exist when there is a relevant and appropriate relationship between the data controller and the data subject concerned, for example when the data subject is a customer of the data controller. In particular, it is a legitimate interest of the data controller to process personal data of the Customer/data subject: for fraud prevention purposes, for direct marketing purposes, to ensure the free circulation of the same data within the business group to which the data controller, if any, belongs, or relating to traffic, in order to ensure network and information security, that is the ability of a network or a system to withstand unforeseen events or illegal acts that could jeopardize the availability, authenticity, integrity and confidentiality of data.
- Circulation of personal data
(8a) Communication of personal data – categories of recipients In addition to the employees and collaborators in their various capacities of the data controller (who are authorized by the same data controller through appropriate written operating instructions, in order to guarantee the confidentiality and security of data), some processing operations may also be carried out by third parties, to whom the data controller entrusts certain activities, or part of them, functional to the purposes referred to in point (4a), therefore, for the execution of contractual and legal obligations, among which, in any case, inevitably, not exhaustively can be mentioned: commercial and/or technical partners; companies that provide banking and financial services; companies that perform document archiving services; debt collection companies; accounting auditing and certification company; rating agencies; subjects that perform professional assistance and advice for the data controller; companies that carry out customer care activities; factoring, credit securitization companies or other credit transferee companies; Group companies to which the data controller may belong; subjects that provide commercial information; IT services company. The subjects belonging to the aforementioned categories process the same personal data as independent data controllers, or as responsibles for the processing with reference to specific processing operations that are part of the contractual services that the same subjects perform in favor/in the interest of the data controller; the data controller provides the data processors with adequate written operating instructions, with particular reference to the adoption of the minimum security measures, in order to guarantee the confidentiality and security of the data.
Some processing operations may be carried out by third parties, to whom the data controller entrusts certain activities, or part of them, also functionally to the purposes referred to in point (4b), among which however, inevitably, not exhaustive can be mentioned: commercial and/or technical partners; companies that provide institutional marketing services; advertising agencies; subjects that provide assistance and consultancy with reference to competitions and prize operations. The subjects belonging to the aforementioned categories process personal data as autonomous data controllers, or as responsibles for the processing, with reference to specific processing operations that are part of the contractual services that the same subjects perform in favour of/in the interest of data controller; the data controller provides the data processor with adequate written operating instructions, with particular reference to the adoption of the minimum security measures, in order to guarantee the confidentiality and security of the data.
The list, subject to periodic updating, of the data processors with whom the data controller has relations, is available, upon written request to be sent to the headquarters of the data controller.
Personal data can also be communicated, in case of request, to the competent authorities, in fulfillment of obligations deriving from mandatory laws.
(8b) Transfer of personal data to third countries Personal data of the Customer/data subject can also be transferred abroad, both in European Union countries and in countries outside the European Union and, in the latter case, either based on an adequacy decision, or in the context and with the appropriate guarantees provided by the GDPR (therefore, in particular, in the presence of contractual clauses of data protection type approved by the European Commission), or, outside the hypotheses above, using one or more of the exceptions provided for by the GDPR (in particular, by virtue of the explicit consent of the Customer/data subject, or for the execution of the Contract concluded by the Customer/data subject, or for the execution of a contract stipulated between the data controller and another natural or legal person in favor of the Customer/data subject, in particular for the execution of activities requested by the data controller for the execution of the Contract concluded with the Customer/data subject). In case of transfers of data to countries outside the European Union, the Customer/data subject is allowed, upon written request to be sent to the headquarters of the data controller, to be informed about the appropriate guarantees, or the derogations, which legitimize cross-border treatment. It is understood that in case of transfer of data to countries outside the European Union, for every request concerning the data, also for the exercise of the rights recognized by the GDPR to the customer/data subject, the latter can always contact the data controller.
- Criteria for determining the retention period of personal data
For the purposes referred to in point (4a) above, the retention period of personal data provided by the Customer/data subject, and the consequent potential treatment thereof, coincides with the period of prescription of the rights/duties (legal, fiscal, etc.) deriving from the Contract: basically 10 years, therefore, except for the occurrence of interruptive events of the prescription that could effectively extend this period.
For the purposes referred to in paragraph (4b) above, the retention period of the data provided by the Customer/data subject, and their consequent potential treatment, ends with the revocation of the consent previously given by the same Customer/data subject or, failing this, however, after one year from the termination of any relationship between the data controller and the Customer/data subject.
- Rights of the Customer/data subject
The data controller acknowledges – and facilitates the exercise, by the Customer/data subject, of all rights provided for by GDPR, in particular the right to request access to his/her personal data and extract a copy (Article 15 of the GDPR), the amendment (Article 16 of the GDPR) and the deletion of the same (Article 17 of the GDPR), the limitation to the processing that concerns him/her (Article 18 GDPR), the portability of data (art. 20 GDPR, if the conditions are met) and to oppose the treatment that concerns him/her (art. 21 and 22 GDPR, for the assumptions mentioned therein and, in particular, to the treatment for marketing purposes or which results in an automated decision-making process, including profiling, which produces legal effects that concerns him/her, if the conditions are met).
The data controller also recognizes the Customer/data subject’s entitlement, if the processing is based on the consent, to revoke such consent at any time, without prejudice to the lawfulness of the treatment based on the consent given prior to the revocation. To do so, the Customer/data subject may unsubscribe at any time on the Website (or other social or web applications of the data controller) or by using the appropriate link at the bottom of any commercial communication received, or by contacting the Data Controller at the contact details above.
The data controller also informs the Customer/data subject about the right to lodge a complaint at the Authority for the Protection of Personal Data, as a supervisory authority operating in Italy, and of judicial appeal against a decision of the Guarantor Authority and against the data controller and/or a data processor.
- Security and data protection
In the light of the state of the art and the cost of their implementation, as well as the nature of the object, the context and the purpose of the processing, as well as the risk in terms of likelihood and severity, for rights and freedom of individuals, the data controller shall take appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in particular by ensuring, on a permanent basis, confidentiality, integrity, availability and resilience of systems and processing services (including through the encryption of personal information whenever necessary) and the ability to restore timely data availability in case of physical or technical accident, and to adopt internal procedures designed to test, verify and assess regularly the effectiveness of the technical and organisational measures employed.
In assessing the appropriate level of security account shall be taken in particular of the risks deriving from processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or accidental or illegal access to personal data transmitted, stored or otherwise processed.
The data controller shall ensure that anyone acting under his/her authority and having access to personal data processes such data only on instructions to do so by the data controller.
This being said, the Customer/data subject acknowledges and accepts that no security system guarantees, in terms of certainty, absolute protection; therefore, the data controller is not liable for acts or facts of third parties who, despite the appropriate measures taken, should have access to the systems without proper authorization.
- Automated decision-making processes, including profiling
The data controller may perform automated processing, including profiling, in relation to the purposes referred to in point (4b) above, to optimize the navigability of the Site (or the usability of other social or web applications of the data controller) and to improve the purchasing experience, except for what is specified above with regard to the rights of opposition and revocation of consent by the Customer/data subject.
Profiling means any form of automated processing of personal data aimed at evaluating certain aspects relating to a natural person, in particular to analyze or predict aspects concerning, for example, the personal preferences, interests or location of that person, also in order to create profiles, ie homogeneous groups of subjects by characteristics, interests or behaviour.
The data controller does not carry out any automated processing that produces legal effects affecting the Customer/data subject or that significantly affecting his/her person, unless this is necessary for the conclusion or execution of the Contract, it is authorized by law or it is based on the explicit consent of the Customer/data subject, in any case always recognizing the entitlement of latter to obtain human intervention, to express his/her opinion and to challenge the decision.