INFORMATION REGARDING THE PERSONAL DATA PROCESSING OF THE WEBSITE USERS (pursuant to Article 13 of EU Regulation 2016/679 “GDPR”)
1. Responsible party
The responsible party within the meaning of Art. 4 Para. 7 EU-General Data Protection Regulation (“GDPR”) is:
Cominelli F. & C. S.n.c., with registered office in Via Bivio Risparmio 6, Leno 25024 (BS) Italy, VAT number 00619650989.
Its legal representatives, Messrs. Roberto Cominelli and Francesco Cominelli, as Data Controllers (here in after “Owner” or “Cominelli”) inform you in accordance with the Italian Legislative Decree. no. 196 of 30.6.2003 modified by Legislative Decree no. 101 of 10 August 2018 (here in after, “Privacy Code”) and art. 13 of EU Regulation no. 2016/679 (hereinafter, “GDPR”) that your data will be processed in the manner and for the purposes specified below.
The personal data provided by its Customers, including Users of the Website www.cominellimacchine.it (hereinafter referred as “the Interested Parties”) to Owner may include e.g. name and surname, address, date and place of birth, tax code, mobile phone number, e-mail address (hereinafter referred as “Data”).
2. Owner and Data Processors
The Data Controller is Cominelli, with registered office in via in Bivio Risparmio 6, Leno 25024 (BS), email address firstname.lastname@example.org and telephone number +39 030 9038880. The complete list of the Data Processors, appointed by the Data Controller, is available upon written request sent to the e-mail address indicated above.
3. Purpose of the processing
The data collected by the Owner can be used for the following purposes:
- To allow the Interested Party to create a personal account, to register on the Website and to carry out the activities of the Website, including purchases and services (hereinafter jointly referred to as “Contractual Purposes“);
- To comply with any legal and regulatory obligations (hereinafter referred to as “Legal Purposes“);
- With the consent of the Interested Party, the Owner can send newsletters and commercial communications through traditional and remote means of communication including: email, SMS, MMS, social networks, instant messages, mobile applications, banners, faxes, mail and telephone. The Owner can inform the Interested Party about promotion, sale of products and services and for customer satisfaction surveys (“Marketing Purposes of the Owner“);
- With the consent of the Interested Party, the Owner can send newsletters and commercial communications relating to the products and services by email, SMS. The User will receive no more than 3 communications per month identified solely on the basis of non-invasive categories of belonging, such as, age group, the opening of previous newsletters received, the ways in which the Interested Party makes his purchases (“Profiled Marketing Purpose“);
- To perform functional activities for company and business unit transfers, acquisitions, mergers, demergers or other transformations and for the execution of such operations (“Purpose of Legitimate Business Interest“).
4. Legal basis:
- The processing of personal data for the Contractual Purposes is mandatory, as it is necessary for the purposes of registration, for the performance of the Website’s activities, for the purchase of products and for the use of specific services offered also through the Website, pursuant to art. 6, par. 1, lett. b) of the GDPR;
- The processing of personal data for the purposes of the law is mandatory, as it is required under applicable laws, pursuant to art. 6, par. 1, lett. c). In the event that the Interested Party does not want their personal data to be processed for these purposes, he/she will not be able to use the website and the services available on the Website itself;
- The processing of personal data for the Marketing Purposes of the Data Controller is optional and subject to the prior consent of the Interested Party, pursuant to art. 6, par. 1, lett. a) of the GDPR. Any failure to give consent determines the impossibility for the Data Controller to keep the Interested Party updated on new products or services, promotions, customized offers, as well as to carry out market surveys and to send communications or other informative material consistent with his/her interests;
- The processing of personal data for Profiled Marketing Purposes is optional and subject to the prior consent of the Interested Party, pursuant to art. 6, par. 1, lett. a) of the GDPR. Any failure to give consent determines the impossibility for the Data Controller to send the Interested Party communications or other informative material that may be consistent with his/her interests;
- The processing for the Purposes of Legitimate Business Interest is carried out pursuant to the article art. 6, par. 1, lett. f) of the GDPR and for the pursuit of the legitimate interest of the Owner and its counterparties in carrying out the economic operations. The process is consistent with the interests of the Users as it takes place within the strictly necessary limits to carry out these operations.
5. Communication and diffusion of the data
The Data Controller may communicate the data of the Interested Parties strictly necessary for each type of treatment to carry out the purposes referred to in paragraph 3. The categories of third parties subjects are the following:
- to collaborators, employees and suppliers, in the context of their duties and / or any contractual obligations with them, concerning commercial relations with Users;
- to subcontractors engaged in activities related to the accomplishment of the services and products offered by the Owner;
- to other companies of the owner’s group both in Italy and abroad, both national and international, as described in paragraph below;
- to post offices, freight forwarders and couriers in charge of shipping the products purchased by the interested party and / or other material relating to carry out the Owner’s services;
- to legal, administrative and tax consultants where necessary or functional to carry out the Data Controller’s activity, in the ways and for the purposes described above;
- to banks for the management of collections and payments deriving from the execution of contracts with the Interested Party.
The personal data of the interested party will not be disclosed and will not be transferred outside the national territory.
6. Rights of the interested party:
At any time, the Interested Parties can exercise their rights towards the Data Controller, pursuant to articles from 15 to 22 and art. 34 of the GDPR. In particular, the GDPR entitle the Interested Parties:
- To ask Data Controller access to their personal data and related information (Right of access of the Interested Party); the modification of inaccurate personal data or the integration of incomplete data (Right to rectification); the cancellation of personal data concerning them – upon the occurrence of one of the conditions indicated in art. 17, paragraph 1 of the GDPR and in compliance with the exceptions provided for in paragraph 3 of the same article – (Right to cancellation); the limitation of the processing of their personal data – when one of the hypotheses indicated in art. 18, paragraph 1 of the GDPR – (Right to restrict processing);
- To request and obtain from the Data Controller their data in a machine-readable electronic format, also for the purpose of communicating such data to another data controller (Right to data portability). This is in the event that the legal basis of the processing is the contract or consent, and it is carried out by automated means;
- To object at any time to the processing of the personal data when particular situations that concern them occur (Right to object);
- To withdraw consent for the processing of personal data at any time if the treatment is based on their consent for one or more specific purposes. However, the treatment based on consent and carried out retains its lawfulness prior to the revocation;
- To file a complaint to a supervisory authority (Italian Guarantor Authority for the protection of personal data – www.garanteprivacy.it).
7. Storage period.
The collected data will be kept for the period needed to achieve the purposes for which they are processed and / or for the time necessary to fulfill legal obligations. In any case, the storage periods apply to the processing of personal data for the purposes indicated below:
- The data collected for the Contractual Purposes referred to in paragraph 3, lett. a) are kept for the entire duration of the contract and for 10 years following the expiration for defense purposes and / or to assert a right of the Owner in court and / or out of court in case of disputes related to the execution of the contract ;
- The data collected for the Legal Purposes referred to in paragraph 3, lett. b) are kept for a period equal to the duration prescribed by law for each type of data;
- The data collected for the Marketing Purposes of the Data Controller referred to in paragraph 3, lett. c) are kept for a period equal to the entire duration of the registration of the Interested Party on the Website through their account as well as for the 2 years following the end, deactivation and / or cancellation;
- The data collected for Legitimate Business Interest Purposes referred to in paragraph 3, lett. e) wil be stored for a period of 10 years from the moment of collecting.
Once the above terms have expired, the data of the Interested Party may be deleted, anonymized and / or aggregated.