Privacy Policy

As a data controller, he declares that personal data collected for the purposes set out in the contract / assignment or for the additional purposes for which the interested party has given specific consent will be treated, pursuant to and for the purposes of art. 5 of EU Regulation 679/2016, in a lawful, correct and transparent manner with regard to the interested party and collected for the aforementioned purposes only, according to the principles of accuracy, adequacy, confidentiality and protection enshrined in the Regulation. Further information regarding the rights of the data subject and the methods of keeping personal data are contained in the information provided for in articles 13 and 14 of EU Regulation 679/2016 delivered to each interested party and in the treatment registers, distinguishing data types, risk analyzes and preventive measures taken. The data controller assumes all responsibility for compliance with the aforementioned principles, contents and provisions of the European Regulation for the protection of personal data and for the correct and regular maintenance and management of such data.

 

The European Regulation n. 679/2016 GDPR, applicable in all Member States, recognizes to each subject the protection of their personal data that is subject to processing by third parties, as an expression of respect for human dignity and the fundamental rights and freedoms of the person. Furthermore, the subject concerned with the processing of personal data has a series of rights that he can exercise towards the Data Controller or Manager who holds your personal data, regulated by articles 15 and following of the European Regulation, detailed below. and made available to the interested party who requests it. Therefore, based on the provisions of the European and internal regulations in force, we provide you with the following detailed information on your rights:

 

1. Right of access of the interested party (Article 15 GDPR)

 

The interested party has the right to obtain from the controller the confirmation that the processing of personal data concerning him is being carried out and in this case, to obtain access to personal data and to the following information:

 

a) the purposes of the processing;

b) the categories of personal data in question;

c) the recipients or categories of recipients to whom the personal data have been or will be communicated, in particular if they are recipients of third countries or international organizations;

d) when possible, the period of storage of personal data provided or, if this is not possible, the criteria used to determine this period;

e) the existence of the right of the data subject to request the data controller to rectify or delete personal data or limit the processing of personal data concerning him or to oppose their processing;

f) the right to lodge a complaint with a supervisory authority;

g) if the data is not collected from the interested party, all available information on their origin;

h) the existence of an automated decision-making process, including the profiling referred to in Article 22, paragraphs 1 and 4, and, at least in such cases, significant information on the logic used, as well as the importance and expected consequences of such treatment for the interested party.

If personal data is transferred to a third country or an international organization, the data subject has the right to be informed of the existence of adequate guarantees pursuant to Article 46 relating to the transfer. the data subject is also entitled to obtain a copy of the personal data subject to processing, provided that the request does not infringe the rights and freedoms of others.

 

2. Right to rectify personal data (Article 16 GDPR)

 

The interested party has the right to obtain from the data controller the rectification of inaccurate personal data concerning him without undue delay. Taking into account the purposes of the processing, the data subject has the right to obtain the integration of incomplete personal data, also by providing a supplementary declaration.

 

3. Right to cancellation ("right to oblivion") (Article 17 GDPR)

 

The data subject has the right to obtain from the data controller the deletion of personal data concerning him without undue delay and the data controller has the obligation to delete personal data without unjustified delay, if one of the following reasons exists:

 

a) personal data are no longer necessary with respect to the purposes for which they were collected or otherwise processed;

b) the data subject withdraws the consent on which the processing is based in accordance with Article 6, paragraph 1, letter a), or Article 9, paragraph 2, letter a) GDPR, and if there is no other legal basis for the treatment;

c) the data subject opposes the processing pursuant to Article 21, paragraph 1 GDPR, and there is no legitimate prevailing reason to proceed with the processing, or he opposes the processing pursuant to Article 21, paragraph 2 GDPR;

d) personal data have been unlawfully processed;

e) personal data must be deleted in order to fulfill a legal obligation established by the law of the Union or of the Member State to which the data controller is subject;

f) personal data has been collected in relation to the offer of information society services referred to in Article 8, paragraph 1 GDPR.

The data controller, if he has made personal data public and is obliged, pursuant to paragraph 1, to delete them, taking into account the available technology and the implementation costs, takes reasonable measures, including technical, to inform the data controllers who are processing processing personal data of the request of the interested party to cancel any link, copy or reproduction of his personal data. Paragraphs 1 and 2 do not apply to the extent that processing is necessary:

 

a) for the exercise of the right to freedom of expression and information;

b) for the fulfillment of a legal obligation that requires the treatment foreseen by the law of the Union or of the Member State to which the holder of the treatment is subject or for the execution of a task carried out in the public interest or in the exercise of public authority of which the data controller is invested;

c) for reasons of public interest in the field of public health in accordance with Article 9, paragraph 2, letters h) and i), and Article 9, paragraph 3 GDPR;

d) for archiving purposes in the public interest, for scientific or historical research or for statistical purposes in accordance with Article 89, paragraph 1, to the extent that the right referred to in paragraph 1 risks rendering impossible or seriously affecting the achievement of the objectives of such treatment;

e) for the establishment, exercise or defense of a right in court.

 

 

4. Right to limitation of treatment (Article 18 GDPR)

 

The interested party has the right to obtain the treatment limitation from the data controller when one of the following hypotheses occurs:

 

a) the data subject disputes the accuracy of the personal data, for the period necessary for the data controller to verify the accuracy of such personal data;

b) the processing is unlawful and the data subject opposes the deletion of personal data and requests instead that its use be limited;

c) although the data controller no longer needs it for the purposes of processing, personal data is necessary for the data subject to ascertain, exercise or defend a right in court;

d) the data subject has opposed the processing pursuant to Article 21, paragraph 1, pending verification of the possible prevalence of the legitimate reasons of the data controller with respect to those of the data subject.

 

If processing is limited pursuant to paragraph 1, such personal data shall be processed, except for storage, only with the consent of the data subject or for the establishment, exercise or defense of a right in court or for protect the rights of another natural or legal person or for reasons of significant public interest of the Union or of a Member State. The data subject who obtained the processing limitation pursuant to paragraph 1 shall be informed by the data controller before the limitation is revoked.

 

5. Obligation to notify in the event of rectification or cancellation of personal data or limitation of processing (Article 19 GDPR)

 

The data controller informs each of the recipients to whom the personal data were sent of any adjustments or deletions or limitations of the processing carried out pursuant to Article 16, Article 17, paragraph 1, and Article 18, except where proves impossible or involves a disproportionate effort. The data controller shall inform the data subject of these recipients if the data subject requests it.

 

6. Right to data portability (Article 20 GDPR)

 

The interested party has the right to receive in a structured format, commonly used and readable by automatic device, the personal data concerning him provided to a data controller and has the right to transmit such data to another data controller without hindrance by part of the data controller to whom he supplied them if:

 

a) the processing is based on consent pursuant to Article 6, paragraph 1, letter a), or Article 9, paragraph 2, letter a), or on a contract pursuant to Article 6, paragraph 1, letter b);

b) the processing is carried out by automated means.

In exercising their rights with respect to data portability pursuant to paragraph 1, the data subject has the right to obtain direct transmission of personal data from one data controller to another, if technically feasible. The right referred to in paragraph 1 must not affect the rights and freedoms of others.

 

7. Right to object (Article 21 GDPR)

 

The interested party has the right to object at any time, for reasons related to his particular situation, to the processing of personal data concerning him pursuant to Article 6, paragraph 1, letters e) of), including profiling on the basis of these provisions. The data controller refrains from further processing personal data unless he demonstrates the existence of legitimate cogent reasons for processing that prevail over the interests, rights and freedoms of the data subject or for verification, exercise or the defense of a right in court. If personal data is processed for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data concerning him for these purposes, including profiling to the extent to which it is connected to such direct marketing. If the interested party objects to the processing for direct marketing purposes, the personal data are no longer processed for these purposes. The right referred to in paragraphs 1 and 2 is explicitly brought to the attention of the interested party and is presented clearly and separately from any other information at the latest at the time of the first communication with the interested party. In the context of the use of information society services and without prejudice to Directive 2002/58 / EC, the interested party may exercise his right to object by automated means that use specific techniques. If personal data are processed for scientific or historical research purposes or for statistical purposes pursuant to Article 89, paragraph 1, the data subject, for reasons related to his particular situation, has the right to object to the processing of personal data which concerns, except if processing is necessary for the performance of a public interest task.

 

8. Automated decision-making relating to individuals, including profiling (Article 22 GDPR)

1. The interested party has the right not to be subjected to a decision based solely on automated processing, including profiling, which produces legal effects that concern him or that significantly affects his person.

2. Paragraph 1 does not apply if the decision:

a) is necessary for the conclusion or execution of a contract between the data subject and a data controller;

b) is authorized by the law of the Union or of the Member State to which the data controller is subject, which also specifies appropriate measures to protect the rights, freedoms and legitimate interests of the data subject;

c) is based on the explicit consent of the interested party.

3. In the cases referred to in paragraph 2, letters a) and c), the data controller shall implement appropriate measures to protect the rights, freedoms and legitimate interests of the data subject, at least the right to obtain human intervention by the owner processing, to express their opinion and to challenge the decision.

4. The decisions referred to in paragraph 2 shall not be based on the special categories of personal data referred to in Article 9 (1), unless Article 9 (2) (a) or (g) applies, and there are no adequate measures in place to protect the rights, freedoms and legitimate interests of the data subject.

GDPR COMPLIANCE

Data Rectification

You can use the links below to update your account data if it is not accurate.

Data Portability

You can use the links below to download all the data we store and use for a better experience in our store.

Access to Personal Data

You can use the link below to request a report which will contain all personal information that we store for you.

Right to be Forgotten

Use this option if you want to remove your personal and other data from our store. Keep in mind that this process will delete your account, so you will no longer be able to access or use it anymore.