Privacy policy

 

PRIVACY NOTICE AND CONSENT TO THE PROCESSING OF PERSONAL DATA

For the purposes set out in EU Regulation no. 2016/679 (also known as the General Data Protection Regulation: “GDPR”) concerning the protection of natural persons with regard to the processing of personal data (as defined below), we inform you that the data provided by you to the data controller (as identified below) will be processed in full compliance with the aforementioned legislation and according to the following principles:

1. Data Controller

The data controller is LOMA SRL, with registered office in Italy, Ponte nelle Alpi (BL), Viale Dolomiti 54/Q, E-mail loma@orodolomiti.it, Tax Code and VAT no. 00936650258  (the “Data Controller”).

2. Categories of personal data processed

Please note that “Personal Data” means any information relating to an identified or identifiable natural person (“Data Subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to his or her physical, physiological, genetic, mental, economic, cultural or social identity (Art. 4 GDPR).

The following categories of Personal Data relating to you may be collected through the various services and contact channels described in this Notice, with particular reference to the e-shop on the website https://www.orodolomiti.it/ (the “Website”):

  1. Contact details – name, address, landline or mobile phone number, email address and similar information;
  2. Other Personal Data – information you provide to us regarding your date of birth, education or professional status, tax code, bank details, credit card number and similar information;
  3. Use of the Website and receipt of communications – information relating to how you use our websites, open or forward our communications, including information collected through cookies and other tracking technologies (you can find our Cookie Policy at the following link: https://www.orodolomiti.it/it/cookie-policy).


3. Purposes and legal bases of processing

The Personal Data collected are used by the Data Controller for the purposes and on the legal bases indicated below:

  • To provide the products and services requested by the customer in a timely and accurate manner, including completing online sales exclusively on the Website in accordance with the terms and conditions of sale available in the e-shop section of the Website; in this case, 

  • the processing is necessary for the performance of a contract to which the data subject is party or in order to take pre-contractual steps at the request of the data subject (Art. 6, para. 1, letter b) GDPR);

  • To comply with legal, administrative, accounting and financial obligations arising from any legal relationship to be entered into or already in place with the Data Controller and related ancillary activities, and to comply with all legal obligations, regulations and/or EU/international rules; in this case, the processing is necessary for compliance with a legal obligation to which the Data Controller is subject (Art. 6, para. 1, letter c) GDPR);

  • To provide support services, including warranty and after-sales support services and related ancillary activities, including verification of the level of customer satisfaction; in this case, the processing is necessary for the performance of a contract to which the data subject is party or in order to take pre-contractual steps at the request of the data subject (Art. 6, para. 1, letter b) GDPR);

  • To inform customers about the activities and products offered on the Website by sending commercial communications via email; in this case, the processing is necessary for the pursuit of the legitimate interest of the Data Controller or of third parties (Art. 6, para. 1, letter f) GDPR);

  • To inform users about the activities and products offered on the Website by sending commercial communications via email; in this case, the processing is based on the fact that the data subject has given consent, which is optional, to the processing of his or her Personal Data for one or more specific purposes (Art. 6, para. 1, letter a) GDPR);

  • To carry out profiling activities concerning data subjects (based on characteristics, behaviours, choices and habits) in order to provide services or personalised promotions addressed to them; in this case, the processing is based on the fact that the data subject has given consent, which is optional, to the processing of his or her Personal Data for one or more specific purposes (Art. 6, para. 1, letter a) GDPR).

Please note that consent may be personally given only by a data subject who is at least 14 years old. Where the minor is under 14 years of age, processing is lawful only if and to the extent that such consent is given or authorised by the holder of parental responsibility.

4. Processing methods and security measures

The processing of Personal Data is based on the principles of fairness, lawfulness and transparency and is carried out using IT tools or paper archives suitable for the management and transmission of such data. Processing is carried out using appropriate tools, as far as reasonably possible and according to the state of the art, to ensure security and confidentiality through the use of suitable procedures designed to prevent the risk of loss, unauthorised access, unlawful use and dissemination.

The Website may contain links to third-party websites or platforms. The Data Controller cannot control or be held responsible for the conduct of such third-party websites or platforms in relation to personal data protection legislation. We invite you to review the privacy notices of third-party websites to check how they collect, store or process Personal Data.

Security measures have been adopted in the settings and processing carried out through the Website to prevent the loss, destruction or dissemination of Personal Data. Nevertheless, the natural security risks connected with the online transmission of Personal Data cannot be completely excluded.

5. Data Processors

For the pursuit of the purposes indicated above, the Data Controller may disclose and have the Personal Data provided by you processed, in Italy and abroad, by third parties that the Data Controller will appoint to process Personal Data on its behalf.

The Data Controller uses only Data Processors that provide sufficient guarantees to implement appropriate technical and organisational measures so that processing meets legal requirements and ensures the protection of the Data Subject’s rights.

The Data Controller shares with Data Processors only the Personal Data strictly necessary for the Data Processors to perform their functions and provide the services requested by the Data Controller in relation to activities concerning Data Subjects.

The Data Controller undertakes to ensure that the processing of Personal Data by a Data Processor is governed by a contract or other legal act binding the Data Processor to the Data Controller and specifying the subject matter and duration of the processing, the nature and purpose of the processing, the type of Personal Data and the categories of data subjects, as well as the obligations and rights of the Data Controller.

Furthermore, Personal Data may be disclosed to competent public bodies and authorities where required by applicable law and/or to third parties for the exercise of a right in judicial proceedings on the basis of the GDPR.

The categories of Data Processors to whom Personal Data are disclosed may be obtained by contacting the Data Controller at the email address: loma@orodolomiti.it

6. Transfer of personal data outside the European Union

As part of its contractual relationships, the Data Controller may transfer the Personal Data processed to countries located outside the European Economic Area (EEA), including by storing them in databases managed by entities operating on its behalf. The management of databases and the processing of Personal Data are connected to the purposes of processing and are carried out in compliance with the applicable legislation on the protection of Personal Data.

If Personal Data are transferred outside the EEA to countries for which no adequacy decision has been adopted by the EU Commission, or where processing outside the EEA is not necessary for the performance of contractual services in favour of the Data Subject, the Data Controller will adopt all appropriate contractual measures to ensure adequate protection of Personal Data, including agreements based on the standard contractual clauses adopted by the EU Commission to regulate the transfer of personal data outside the EEA.

7. Retention of Personal Data

The Data Controller retains Personal Data only for the time necessary to achieve the purposes for which they were collected or for any other related legitimate purpose (for example, where they are relevant for defending against claims brought against the Data Controller or where there is a legitimate interest). If consent is withdrawn, Personal Data may still be retained in order to manage any disputes and/or litigation.

Without prejudice to the right to erasure within the limits provided by law, where the retention of Personal Data is no longer permitted or required by applicable legislation, the maximum retention period for Personal Data shall be seven (7) years from the date of the Data Subject’s last interaction with the Website.

8. Rights of Data Subjects

We remind you that each Data Subject may exercise his or her rights in relation to the protection of Personal Data at any time.

In particular, the Data Subject is entitled to:

  • Receive, free of charge, clear information regarding the Personal Data that the Data Controller processes and stores, including the right to know which Data have been collected and how they are processed;

  • Request the amendment of his or her Personal Data if they are no longer up to date or accurate;

  • Request the erasure of his or her Personal Data, within the limits provided by law;

  • Restrict the processing of the Personal Data provided in certain circumstances;

  • Receive, in a structured, commonly used and machine-readable format, the Personal Data concerning him or her that have been provided to a data controller, and have the right to transmit those data to another data controller without hindrance from the data controller to whom they were provided;

  • Object to the processing of his or her Personal Data;

  • Withdraw his or her consent at any time without affecting the lawfulness of processing based on consent before its withdrawal;

  • Lodge a complaint with the competent supervisory authority.

These rights may be exercised by sending a written communication by email to the following address: loma@orodolomiti.it





 

Create an email signature online