Information note concerning the processing of personal data pursuant to Regulations (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (“GDPR” or “Regulations”)

Summary

• 1. Identity and contact details of Ca’ di Nieri S.r.l. in its capacity as data controller.
• 2. Data processing for the purpose of purchasing the services offered by Ca’ di Nieri S.r.l.
• 3. Data processing for general marketing purposes
• 4. Data processing for profiling purposes
• 5. Data processing for purposes of assistance and customer care
• 6. Data processing for administrative, accounting and tax purposes
• 7. Data processing for the purposes of ascertaining, exercising or defending a right
• 8. Categories of subjects to whom Ca’ di Nieri s.r.l. transmits the personal data of the user (recipients)
• 9. Transfer to third countries
• 10. Right of opposition
• 11. Right of access
• 12. Right of rectification
• 13. Right of cancellation
• 14. Right to restriction of processing
• 15. Right to data portability
• 16. Timing and methods of response in case of exercising the rights of the data subject
• 17. Right to lodge a complaint with a supervisory authority

Art. 1. Identity and contact details of Ca’ di Nieri S.r.l. in its capacity as data controller.

Ca’ di Nieri S.r.l. (“Ca’ di Nieri”) is the data controller of the users’ personal data as described in this policy and which concerns the data collected from the website www.cadinieri.com for the purposes indicated therein.

The identification and contact details of Ca’ di Nieri are as follows:

• Ca’ di Nieri S.r.l. with registered office in 06010 Monte Santa Maria Tiberina (PG), Vocabolo Ca’ di Nieri 79, registered in the Register of Companies of Perugia, with VAT number 0
• E-mail: barbara@cadinieri.com, info@cadinieri.com

Art. 2. Data processing for the purpose of purchasing the services offered by Ca’ di Nieri

Ca’ di Nieri will process the user’s personal data to:

• allow the user to acquire information and enter into contracts relating to the services offered by the structure;
• allow Ca’ di Nieri to correctly perform the obligations arising from such contracts;
• carry out the pre-contractual requests sent by the user.

The legal basis for this processing is the fulfillment of the contract or, depending on the case, the execution of pre-contractual measures taken at the request of the data subject (art. 6.1.b) of the Regulations).

The user who intends to use the services offered by the structure must send an email to the address info@cadinieri.com or contact the phone number +39. 342.7533484.

For this purpose, Ca’ di Nieri will process the user’s data for the time strictly necessary to carry out the individual processing activities, it being understood that, after this period, Ca’ di Nieri may store the data for the purposes and for the maximum retention periods referred to in the other sections of this information note, if relevant, and/or, in any case, in the cases established by the Regulations and/or the law.

The provision of data for the purpose in question is optional: that is, there is no legal or contractual obligation to transmit data; however, – since their processing is necessary to enable the execution of the contract for purchasing the services offered or to respond to pre-contractual requests made by the user – failure to submit these will make it impossible for the user to purchase the services offered by the structure or to receive a response to his/her pre-contractual requests.

Art. 3. Data processing for general marketing purposes

Subject to the user’s express consent, Ca’ di Nieri will process the user’s personal data in order to send him or her, by e-mail, informative and promotional communications, including the newsletter, relating to own products and/or services and/or to those of third parties.

The legal basis for this processing is the express consent of the user (art. 6.1.a) of the Regulations).

The user may at any time revoke the consent given and/or oppose, at any time, the processing of his/her data for marketing purposes by contacting Ca’ di Nieri at the addresses indicated in art. 1.

The provision of data for general marketing purposes is optional: there is no legal or contractual obligation for the user to provide such data for such purposes and/or to give consent to processing personal data for such purposes.

Failure to consent to the processing of data for marketing purposes will make it impossible for the user to receive advertising material relating to the products and/or services of Ca’ di Nieri and/or of third parties and the impossibility for Ca’ di Nieri to send newsletters to the user.

For general marketing purposes, Ca’ di Nieri will process the user’s data until consent is revoked and/or the right to object is exercised and, in any case, not beyond 24 months from the data collection, reserving the right, prior to expiry of this period, to ask the user to renew consent and/or update data.

Art. 4. Data processing for profiling purposes

Subject to the user’s prior express consent, Ca’ di Nieri will process the user’s personal data for profiling purposes, i.e. in order to develop the user’s business profile, by collecting and processing the choices and buying habits on the website, in order both to monitor the degree of customer satisfaction, so as to better meet customer requirements, and to send advertising material, relating to products and/or services of Ca’ di Nieri and/or of third parties, of specific interest to the user, by means of automated systems, such as e-mail, fax, SMS or MMS, or through traditional methods (e.g.: paper mail or telephone).

The legal basis for this processing is the express consent of the user (art. 6.1.a) of the Regulations).

The user may at any time revoke the consent given and/or oppose, at any time, the processing of data for profiling purposes, if related to direct marketing, by contacting Ca’ di Nieri at the addresses indicated in art. 1.

The provision of data for profiling purposes is optional: there is no legal or contractual obligation for the user to provide such data for such purposes and/or to give consent to the processing of personal data for such purposes.

Failure to consent to the processing of personal data for profiling purposes will make it impossible for Ca’ di Nieri to develop the commercial profile of the user, by identifying his/her choices and purchasing habits on the website (including to ensure greater satisfaction of customer requirements), and to send advertising material, relating to goods and/or services of Ca’ di Nieri and/or of third parties, of specific interest to the user.

For profiling purposes, Ca’ di Nieri will process the user’s data until consent is revoked and/or the right to object is exercised and, in any case, not beyond 12 months from the data collection, reserving the right, prior to expiry of this period, to ask the user to renew consent and/or update data.

Art. 5. Data processing for purposes of assistance and customer care

Ca’ di Nieri will process user data for general assistance and customer care activities and therefore to respond to requests for information from users or to complaints, reports, claims and in order to allow the user, if desired, to provide a review.

The legal basis for this processing is to carry out pre-contractual measures adopted at the request of the data subject (art. 6.1.b, last section, of the Regulations) or, depending on the case, the legitimate interest of Ca’ di Nieri (art. 6.1.f of the Regulations).

It is in the legitimate interest of Ca’ di Nieri to respond to requests for information and/or reviews and/or reports and/or complaints and/or claims by Website users. This legitimate interest of Ca’ di Nieri also coincides with the legitimate interest of said Website users who make the requests and/or reports and/or complaints and/or claims in question and, therefore, within the context of the relationship with Ca’ di Nieri, it can reasonably be expected that their personal data will be used by Ca’ di Nieri to provide answers.

The legitimate interest of Ca’ di Nieri thus identified can therefore be considered to prevail over the fundamental rights and freedoms of the data subject, also in view of these reasonable expectations and of the relationship between the data subject and Ca’ di Nieri as well as in view of the nature of the data processed and the coinciding interest of said data subjects.

In any case. the data subject has the right to object at any time, for reasons relating to his or her particular situation, to the processing of personal data concerning him or her for the purpose in question (i.e. assistance and customer care).

Art. 6. Data processing for administrative, accounting and tax purposes

Ca’ di Nieri will process the user’s data for the purpose of carrying out administrative and/or accounting and/or tax obligations, related to the provision of services and/or the purchase of products offered on the Website.

The legal basis for this processing is the fulfillment of legal obligations to which Ca’ di Nieri is subject (art. 6.1.c of the Regulations).

The provision of data for the purpose in question is mandatory, as their processing is necessary to enable Ca’ di Nieri to fulfill the legal obligations it must comply with. Any refusal to provide data for this purpose will make it impossible for the user to enjoy the services of the Website.

For this purpose, Ca’ di Nieri will process the user’s data until the expiry of the legal terms envisaged for performing each administrative-accounting and fiscal fulfillment and/or for the retention times provided for by law for storing the related documentation.

Art. 7. Data processing for the purposes of ascertaining, exercising or defending a right

Ca’ di Nieri will process the user’s data for ascertaining, exercising or defending a right in all relevant fora.

The legal basis for this processing is the legitimate interest of Ca’ di Nieri (art. 6.1.f of the Regulations).

It is in the legitimate interest of Ca’ di Nieri, in fact, to seek redress to ensure compliance with its contractual rights i.e. to demonstrate that it has fulfilled its obligations according to the contract with the data subject or imposed on Ca’ di Nieri by law. This legitimate interest is based on the constitutionally protected right of defense. It can therefore be considered as taking precedence over the fundamental rights and freedoms of the data subject, even on the basis of the latter’s reasonable expectations.

The user has, in any case, the right to object at any time, for reasons related to his or her personal situation, to the processing of personal data concerning him or her for the purpose in question (i.e. the defence of a right or for legal reasons).

The user can exercise this right by contacting Ca’ di Nieri at the addresses indicated in art. 1 of this privacy policy.

Art.8. Categories of subjects to whom Ca’ di Nieri transmits the personal data of the user (recipients)

The personal data provided by the user may be transmitted by Ca’ di Nieri to the categories of recipients listed below.

The subjects to whom Ca’ di Nieri transmits the data act as data controllers designated by Ca’ di Nieri by means of an appropriate contract (“Data Controllers”) or as persons appointed to process personal data under the direct authority of Ca’ di Nieri (“Processors”) or, in the case of third parties that the Data Controller makes use of, as “Sub-Processors”, pursuant to art. 28.4 of the Regulations.

Users’ personal data may be transmitted by Ca’ di Nieri to the following categories of recipients:

• to companies, consultants or professionals responsible for the installation, maintenance, updating and, in general, the management of the hardware and software of the Website (including the platform), including the providers of cloud computing services, and the third parties they collaborate with;
• to companies appointed by Ca’ di Nieri to send commercial communications;
• to any person or entity, including public authorities, who have access to the data by virtue of regulatory or administrative measures;
• to all those public and/or private subjects, natural persons and/or legal entities (legal, administrative and tax consulting firms), if the communication is necessary or functional to correctly fulfill the contractual obligations undertaken in relation to the products and services offered on the Website, as well as the obligations deriving from the law or in the case of ascertaining, exercising or defending a right.

Art. 9. Transfer to third countries

Personal data are not transferred to countries outside the European Union.

Art. 10. Right of opposition

The data subject shall have the right to object at any time, for reasons relating to his/her particular situation, to the processing of personal data concerning him or her carried out for purposes which have as their legal basis the legitimate interest of the data controller.

In the event that the data are processed for purposes of direct marketing or profiling, the data subject also has the right to object at any time to the processing of personal data concerning him or her carried out for such purposes.

Should the right of objection be exercised, Ca’ di Nieri shall refrain from further processing personal data, unless it proves the existence of legitimate reasons to proceed with the processing that prevail over the interests, rights and freedoms of the data subject or in order to ascertain, exercise or defend a right in court.

Should the data subject object to processing for the purpose of direct marketing or profiling, the personal data shall no longer be processed for that purpose.

Art. 11. Right of access

The data subject shall have the right to obtain from Ca’ di Nieri confirmation as to whether or not personal data concerning him or her are being processed, and, should that be the case, to access the personal data and information listed below.

Should the user exercise his/her right of access, he/she may obtain access to his/her personal data and the following information:

• the purposes of the processing;
• the categories of personal data concerned;
• the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular if third-country recipients or international organizations;
• where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
• the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
• the right to lodge a complaint with a supervisory authority;
• where the personal data are not collected from the data subject, all available information as to their source;
• the existence of an automated decision-making process, including profiling, which produces legal effects concerning the data subject or which has a similar significant impact on the data subject and, at least in those cases, meaningful information concerning the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

Ca’ di Nieri shall provide a copy of the personal data processed. For any further copies requested by the data subject, Ca’ di Nieri may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic format.

Art. 12. Right of rectification

The data subject shall have the right to obtain from Ca’ di Nieri the rectification of inaccurate personal data concerning him or her without undue delay. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

Art. 13. Right of cancellation

The data subject shall have the right to obtain from Ca’ di Nieri the erasure of personal data concerning him or her without undue delay and Ca’ di Nieri shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

• the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
• the data subject withdraws consent on which the processing is based, where there is no other legal ground for the processing;
• the data subject objects to the processing based on the legitimate interest of the data controller on grounds relating to his or her particular situation and there are no overriding legitimate grounds or he/she objects to the processing of his or her personal data for the purposes of direct marketing or profiling;
• the personal data are processed unlawfully;
• the personal data must be erased in order to comply with a legal obligation envisaged by Union or Member State law to which the controller is subject.

Art. 14. Right to restriction of processing

The data subject shall have the right to obtain from Ca’ di Nieri restriction of processing where one of the following applies:

• the accuracy of the personal data is contested by the data subject, for a period enabling Ca’ di Nieri to verify the accuracy of the personal data;
• the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
• Ca’ di Nieri no longer needs the personal data for the purposes of the processing, but they are required by the data subject to establish, exercise or defend a right in court;
• the data subject objected to the processing in the event of processing based on the legitimate interest of the data controller, on grounds relating to his or her particular situation, pending verification as to whether the legitimate reasons of Ca’ di Nieri override those of the data subject.

Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with the data subject’s consent whether for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

A data subject who has obtained a processing restriction shall be informed by the controller before this restriction is lifted.

Art. 15. Right to data portability

The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to Ca’ di Nieri, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:

• the processing is based on the consent of the data subject or on a contract;
• the processing is carried out by automated means.

When exercising his or her right to data portability, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.

Exercising the right to portability does not affect the data subject’s right to erasure.

The right to portability shall not adversely affect the rights and freedoms of others.

Art. 16. Timing and methods of response in case of exercising the rights of the data subject

Ca’ di Nieri provides the data subject with information about the actions taken in relation to a request to exercise the rights recognized by Articles 15 to 22 of these Regulations (i.e. right of access, right of rectification, right of cancellation, right of restriction of processing, right to data portability, right of opposition) and by this privacy policy (“Rights of the Data Subject”), without undue delay and, in any event, within one month from receiving the request itself. This period may be extended by two months, if necessary, taking into account the complexity and number of requests. Ca’ di Nieri shall inform the data subject of any such extension within one month from receiving the request, together with the reasons for the delay. Where the data subject makes the request by electronic means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject.

Art. 17. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, a data subject shall have the right to lodge a complaint with a supervisory authority, notably in the Member State of his or her habitual residence, place of work or place of the alleged infringement if he/she considers that the processing of personal data relating to him or her infringes these Regulations. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of legal proceedings.