Privacy Policy

Privacy Notice on the processing of personal data pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR). In force from 01/01/2022

INTRODUCTION

This Privacy Notice takes into account the provisions of the GDPR and of the Codice della Privacy (Legislative Decree No. 196 of 30 June 2003, the Italian Personal Data Protection Code). The document has also been drawn up on the basis of the Guidelines of the Garante Privacy (the Italian Data Protection Authority), and in particular of the Guidelines on combating spam issued by the Garante Privacy on 4 July 2013.

Data Controller: Gresel SRL

Website to which this privacy policy refers: ingrosso-pelletteria.com (Website).

The Data Controller has not appointed a DPO. You may therefore send any request for information directly to the Data Controller.

GENERAL INFORMATION

This document describes how the Data Controller processes your personal data provided on the Website.

The main processing operations carried out on your personal data are described below. In particular, the legal basis for the processing is explained, together with whether the provision of the data is mandatory and the consequences of failing to provide personal data. In order to describe your rights as fully as possible, where necessary we have specified whether and when a given processing of personal data is not carried out. On the Website you have the possibility of entering personal data of third parties. In such a case, you warrant that you have obtained the consent of those parties to the entry of such personal data. You therefore undertake to indemnify and hold the Data Controller harmless from any liability.

Registration on the Website

The information and data requested upon registration will be used to allow you both to access the reserved area of the Website and to make use of the online services offered by the Data Controller to registered users. The legal basis for the processing is the Data Controller's need to carry out pre-contractual measures taken at the data subject's request. The provision of the data is optional. However, any refusal on your part to provide the data will make it impossible to register on the Website.

Purchases on the Website

Your personal data will be processed in order to allow you to make purchases on the Website. Where an online purchase order is placed, the data are processed in order to allow the conclusion of the purchase contract and the correct performance of the operations connected therewith (and, where required by the applicable sector legislation, in order to comply with tax obligations). The legal basis for the processing is the Data Controller's obligation to perform the contract with the data subject or to comply with legal obligations. Irrespective of the foregoing (and therefore of your consent), the Data Controller may process your data for so-called "soft-spam" purposes, governed by Article 130 of the Codice della Privacy (the Italian Personal Data Protection Code). This means that, limited to the email address provided by you in the context of a purchase through the Website, the Data Controller will process that email address in order to allow the direct offer of similar products/services, provided that you do not object to such processing in the manner set out in this Privacy Notice. The legal basis for the processing is the Data Controller's legitimate interest in sending this type of communication. This legitimate interest may be regarded as equivalent to the data subject's interest in receiving "soft-spam" communications. The Data Controller may send emails to remind the user to complete a purchase. The legal basis for this processing is the Data Controller's legitimate interest in sending this type of communication.

Responding to your requests

Your data will be processed in order to respond to your requests for information. The provision of the data is optional, but your refusal will make it impossible for the Data Controller to answer your questions. The legal basis for the processing is the Data Controller's legitimate interest in following up on the user's requests. This legitimate interest is equivalent to the user's interest in receiving a reply to the communications sent to the Data Controller.

General marketing

Subject to your consent, the Data Controller may process the personal data provided by you in order to send you advertising material and/or newsletters relating to its own products or to those of third parties. The legal basis for this processing is your consent. The provision of personal data for this purpose is entirely optional. Failure to consent to the processing of the data for marketing purposes will make it impossible for you to receive advertising material relating to products/services of the Data Controller and/or of third parties, as well as making it impossible for the Data Controller to carry out market research, including research aimed at assessing the level of user satisfaction, and to send you newsletters.

Commercial communications to our own customers (direct marketing of similar products)

Where you have provided your email address in connection with the purchase of a product, the Data Controller may use it to send you commercial communications relating to its own products similar to those you have already purchased, pursuant to Article 130, paragraph 4, of Italian Legislative Decree no. 196/2003. This processing does not require your consent, but you may object at any time, without formalities and free of charge, either by refusing such use from the outset or on the occasion of each communication received, by using the unsubscribe link at the bottom of every message or by writing to the contact details indicated in the Preamble. The objection takes effect immediately and does not affect in any way the contractual relationship in place.

Profiling

Subject to your consent, the Data Controller may process your personal data for profiling purposes, that is to say for the analysis of your consumer choices through the detection of the type and frequency of the purchases made by you, in order to send you advertising material and/or newsletters relating to its own products or to those of third parties which are of specific interest to you. The legal basis for this processing is your consent. The provision of the data for this purpose is entirely optional. Failure to consent to the processing of your personal data for profiling purposes will make it impossible for the Data Controller to build your commercial profile by recording your purchasing choices and habits, as well as to send you advertising material relating to products of the Data Controller and/or of third parties which are of specific interest to you.

Assignment of data to third parties

For the sending of promotional communications, subject to your express consent, your personal data may be assigned to "third parties". The legal basis for the processing is your consent. The provision of personal data for this purpose is entirely optional. Failure to consent to the assignment will make it impossible to assign your personal data to third parties for advertising purposes.

Geolocation

The Website does not implement any tools for the geolocation of the user's IP address.

Communication of personal data

In the course of its ordinary business, the Data Controller may communicate your personal data to certain categories of parties. In Article 2 you will find the list of the parties to which the Data Controller communicates your personal data. In order to facilitate the protection of your rights, Article 2 may specify in some cases when your data are not communicated to third parties.

The "communication" of personal data to third parties is different from their "assignment" (governed in the preceding paragraph). Indeed, in the case of communication, the third party to which the data are transmitted may use them only for the specific purposes described in its relationship with the Data Controller. In the case of assignment, on the other hand, the third party becomes an autonomous Data Controller of the personal data. Furthermore, your consent is always required in order to assign your personal data to third parties.

Without prejudice to the foregoing, it is understood that the Data Controller may in any case use your personal data in order to properly fulfil the obligations laid down by the laws in force.

SPECIFIC PRIVACY NOTICE

Art. 1 Methods of processing

1.1 The processing of your personal data will be carried out mainly by means of electronic or in any case automated tools, in accordance with the methods and using the instruments suitable to ensure their security and confidentiality in compliance with the GDPR.

1.2 The information acquired and the methods of processing will be relevant and not excessive in relation to the type of services provided. Your data will also be managed and protected in secure IT environments appropriate to the circumstances.

1.3 No "special categories of data" are processed through the Website. Special categories of data are those which may reveal racial and ethnic origin, religious, philosophical or other beliefs, political opinions, membership of parties, trade unions, associations or organisations of a religious, philosophical, political or trade-union nature, health status and sex life.

1.4 No judicial data are processed through the Website.

Art. 2 Communication of personal data

The Data Controller may communicate your personal data to certain categories of parties. The parties to which the Data Controller reserves the right to communicate your data are indicated below:

  • The Data Controller may communicate your personal data to all those parties (including Public Authorities) which have access to personal data by virtue of legislative or administrative measures.
  • Your personal data may also be communicated to all those public and/or private parties, natural persons and/or legal entities (legal, administrative and tax consultancy firms, Judicial Offices, Chambers of Commerce, Labour Chambers and Offices, etc.), where the communication is necessary or instrumental to the correct fulfilment of the obligations arising from the law.
  • The Data Controller makes use of employees and/or collaborators of any kind. For the correct operation of the Website, the Data Controller may communicate your personal data to these employees and/or collaborators.
  • In its ordinary activity of managing the Website, the Data Controller makes use of companies, consultants or professionals appointed to install, maintain, update and, in general, manage the hardware and software of the Data Controller or of which the latter makes use for the provision of its services. Therefore, solely with reference to these purposes, your data may also be processed by these parties.
  • For the sending of its communications, the Data Controller makes use of external companies appointed to send this type of communication (CRM platforms). Your personal data (in particular the email address) may therefore be communicated to these companies.
  • For customer assistance purposes, the Data Controller makes use of one or more companies appointed to provide customer care services. Solely for this purpose, your personal data may be communicated to these companies.

The Controller reserves the right to amend the list indicated above in accordance with its ordinary operations. You are therefore invited to access this Privacy Notice regularly in order to check to which parties the Data Controller communicates your personal data.

Art. 3 Retention of personal data

3.1 This article describes for how long the Data Controller reserves the right to retain your personal data.

  • Your personal data will be retained only for the time necessary to ensure the correct provision of the services offered through the Website.
  • For marketing purposes, personal data will be retained until consent is withdrawn or the processing is objected to and, in any case, for no longer than 24 months from the last purchase or from the data subject's last interaction with the communications received (opening or click). The email address of those who have withdrawn their consent or objected to the processing, together with the relevant date, is retained thereafter for the sole purpose of not sending any further communications.
  • For the purpose of performing the sales contract, the data will be retained for 10 years from the date of receipt of the purchase order. This is in order to allow the Data Controller to exercise its right of defence and to demonstrate that it has correctly performed the contract.
  • For customer care purposes, the data will be deleted once the assistance service has been completed.
  • As provided for by Article 2220 of the Italian Civil Code, invoices, as well as all accounting records in general, are retained for a minimum period of ten years from the date of entry, so that they can be produced in the event of an inspection.

3.2 Without prejudice to the provisions of Article 3.1, the Data Controller may retain your personal data for the period required by specific legislation, as amended from time to time.

Art. 4 Transfer of personal data

4.1 The Data Controller has its registered office within the European Union. The processing of your data is therefore secure from a regulatory point of view, since it is governed by the GDPR. Should the transfer of your personal data take place to a non-EU country in respect of which the European Commission has issued an adequacy decision, the transfer is in any case deemed to be secure from a regulatory point of view. This Article 4.1 indicates from time to time the countries to which your personal data may possibly be transferred and in respect of which the European Commission has issued an adequacy decision.

  • The user is therefore invited to access this article regularly in order to verify whether the transfer of his or her personal data takes place to a country having these characteristics.

4.2 Without prejudice to the provisions of Article 4.1, your data may also be transferred to non-EU countries in respect of which the European Commission has not issued an adequacy decision. You are therefore invited to consult this Article 4.2 regularly in order to ascertain to which of these countries your data may possibly be transferred. In order to allow the correct functioning of the Website, your personal data may be transferred to the U.S.A.. In such cases, the Data Controller will adopt every suitable contractual measure to ensure an adequate level of protection of personal data, including, among others, the Standard Contractual Clauses approved by the European Commission on 4 June 2021. The email delivery service is provided by Amazon Web Services EMEA SARL, with data processing in a European region; any access by the United States parent company is governed by the Standard Contractual Clauses approved by the European Commission and by the supplementary measures set out in the data processing agreement entered into with the provider.

4.3 In this article the Data Controller indicates the countries to which it may specifically direct its activity. This circumstance may entail the application of the legislation of the country concerned, together with that of the GDPR.

  • At the user's request, the Data Controller will apply to the processing of personal data any more favourable rules provided for by the user's own national legislation.

Art. 4-bis. Recipients of the data and categories of data processors

In order to pursue the purposes described in this Privacy Notice, personal data may be communicated to the following categories of recipients, which act as autonomous controllers or as data processors pursuant to Art. 28 GDPR by virtue of specific agreements:

• providers of hosting and IT infrastructure services, with servers located in the European Union;
• carriers and shipment management platforms (by way of example: BRT S.p.A., GLS Italy, Packlink Shipping S.L.), for the delivery of orders;
• payment service providers (by way of example: PayPal (Europe) S.à r.l. et Cie, S.C.A. for card/PayPal payments; banking institutions for bank transfer payments);
• providers of infrastructure services for commercial communications: the platform used to manage communications is installed on the Data Controller's own servers located in the European Union and the related data are not disclosed to the software producer; for the sole technical delivery of email messages the Data Controller relies on Amazon Web Services EMEA SARL (Amazon SES service), with processing in a European region;
• providers of measurement and analytics tools (by way of example: Google LLC — Google Analytics/Tag Manager), activated only subject to consent to the relevant cookies;
• consultants and professionals (administrative, tax, legal) to the extent necessary for their respective assignments;
• public authorities and supervisory bodies, where the communication is required by law.

With reference to the transfers to third countries referred to in Art. 4: the providers established in the United States (in particular Google LLC) either adhere to the EU-U.S. Data Privacy Framework or ensure the transfer by means of the standard contractual clauses approved by the European Commission (Art. 46 GDPR).

The updated list of data processors is available on request by writing to the Controller at the address [email protected].

Art. 5. Rights of the data subject

Pursuant to Art. 13 of the Privacy Regulation, the Data Controller informs you that you have the right to:

  • request from the Data Controller access to your personal data and the rectification or erasure thereof, or the restriction of the processing concerning you, or to object to their processing, in addition to the right to data portability
  • withdraw your consent at any time, without affecting the lawfulness of the processing based on the consent given before its withdrawal
  • lodge a complaint with a supervisory authority (e.g.: the Garante per la protezione dei dati personali, the Italian Data Protection Authority).

The above rights may be exercised by means of a request addressed, without any formality, to the contact details indicated in the Introduction.

Art. 6. Amendments and Miscellaneous

The Data Controller reserves the right to make changes to this Privacy Notice at any time, giving suitable notice thereof to the users of the Website and in any case ensuring an adequate and equivalent protection of personal data. In order to view any changes, you are invited to consult this Privacy Notice regularly. In the event of substantial changes to this privacy policy, the Data Controller may also give notice thereof by email.