PERSONAL DATA PROCESSING NOTICE

in accordance with art. 13 of EU Regulation 2016/679 of 27/04/2016

This notice is provided pursuant to articles 13 and 14 of EU Regulation 2016/679 (hereinafter, GDPR) to describe the methods of processing personal data that will be carried out when accessing, browsing, and using the website.

This notice is valid only for this website and does not apply to other websites that may be accessed through links on our site or other internet sites.

DATA CONTROLLER

The data controller is G. Preattoni of Preattoni Lorenzo & C. sas, Via della Spiga, 52, 20121 Milan.

PURPOSES OF PROCESSING

The personal data processed by the Data Controller are those provided by you when you place an order and purchase goods, and those collected while browsing or using the services offered on preattoni.it.

G. Preattoni of Preattoni Lorenzo & C. sas may collect data about you such as personal details (name and surname), shipping address, billing address, browsing data, and your purchasing habits.

Your personal data are processed for the following purposes:

a) to conclude and execute the purchase contract of goods offered on preattoni.it;

b) to provide services of preattoni.it such as newsletter subscription;

c) to allow you to register on the Site and enjoy the services reserved for registered users;

d) to manage your requests submitted to our Customer Service;

e) marketing and promotional activities of products and services, commercial communications, both by automated means without the intervention of the operator (e.g., SMS, fax, MMS, email, etc.) and traditional means (via telephone, mail);

f) statistical surveys and analysis with data in aggregate form to understand how users interact and use the Site, to improve our offering and services.

LEGAL BASIS OF PROCESSING

In cases a) to d), the processing of your personal data does not require your express consent as the legal basis for processing is art. 6 lett. b) ("processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract") and e) ("processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller") of the GDPR.

In cases e) and f), the legal basis for the processing of personal data is your express consent (art. 6 lett. a) and art. 7 of the GDPR). Such consent concerns both the automated communication methods and the traditional methods described above. You will always have the right to object easily and free of charge, in whole or in part, to the processing of your data for these purposes, excluding, for example, automated contact methods and expressing your preference to receive commercial and promotional communications exclusively through traditional contact methods.

NATURE OF THE PROVISION OF DATA AND CONSEQUENCES OF ANY REFUSAL TO PROVIDE PERSONAL DATA

The data required for the purposes of letters a), b), c), and d) above must be provided in order to fulfill legal obligations and/or to conclude and execute the contractual relationship and provide the requested services. Therefore, your refusal, even partial, to provide such data would make it impossible for the Provider to establish and manage the relationship itself and to provide the requested service.

The provision of personal data necessary for the purposes of letters e) and f) above is optional; therefore, your refusal to provide such data would make it impossible to carry out the activities described therein.

DATA PROCESSING METHODS

The processing of personal data is carried out by means of the operations indicated in art. 4 n. 2) of the GDPR, for the above purposes, both on paper and electronically, by means of electronic or automated tools, in compliance with current legislation, particularly with regard to confidentiality and security, and in accordance with the principles of fairness, lawfulness, transparency, and protection of Customer rights.

The processing is carried out directly by the controller's organization, by its managers, and/or authorized persons.

COMMUNICATION AND DISCLOSURE

Your personal data may be disclosed, to the extent strictly relevant to the obligations, tasks, and purposes described above and in compliance with applicable law, to the following categories of subjects:

1. entities to whom such communication must be made in order to fulfill or demand compliance with specific obligations established by laws, regulations, and/or EU legislation;

2. companies belonging to the Controller's Group or controlling, controlled, or affiliated companies within the meaning of Art. 2359 of the Italian Civil Code, which act as data processors or for administrative and accounting purposes (activities related to internal organizational, administrative, financial, and accounting activities, in particular, for the fulfillment of contractual and pre-contractual obligations);

3. external natural and/or legal persons providing services instrumental to the activities of the Data Controller for the purposes of point 1 above (e.g., call centers, suppliers, consultants, companies, entities, professional firms). These subjects will act as data processors.

Personal data will not be disseminated in any way.

PERIOD OF RETENTION OF PERSONAL DATA

Personal data will be retained for the entire duration expressed by the contract concluded with the Controller, after which the data will be retained for the time required by law for the preservation of administrative documents, after which they will be deleted.

TRANSFER OF DATA

Personal data are stored on servers located within the European Union. It is understood, however, that the Data Controller, if necessary, may have the option to move the servers outside the EU. In this case, the Controller hereby assures that the transfer of data outside the EU will be carried out in accordance with applicable law, subject to the conclusion of the standard contractual clauses provided by the European Commission.

DATA SUBJECT RIGHTS

As the data subject, you have the rights set out in art. 15 of the GDPR, namely the rights to:

1. obtain confirmation of the existence or not of personal data concerning you, even if not yet recorded, and their communication in an intelligible form;

2. obtain information about: a) the origin of personal data; b) the purposes and methods of processing; c) the logic applied in case of processing carried out with the aid of electronic instruments; d) the identification details of the data controller, of the data processors according to art. 3, paragraph 1, GDPR; e) the subjects or categories of subjects to whom the personal data may be communicated or who may become aware of it as designated representatives in the territory of the State, data processors, or persons in charge of the processing;

3. obtain: a) updating, rectification, or, when interested, integration of data; b) erasure, transformation into anonymous form, or blocking of data processed unlawfully, including data whose retention is unnecessary for the purposes for which the data were collected or subsequently processed; c) certification that the operations referred to in letters a) and b) have been brought to the attention, also as regards their content, of those to whom the data have been communicated, except in the case where such fulfillment proves impossible or involves a use of means manifestly disproportionate to the protected right;

4. object, in whole or in part: a) for legitimate reasons to the processing of personal data concerning you, even if pertinent to the purpose of the collection; b) to the processing of personal data concerning you for the purpose of sending advertising or direct sales material or for carrying out market research or commercial communication, by using automated calling systems without the intervention of an operator via email and/or traditional marketing methods via telephone and/or paper mail. It should be noted that the data subject's right to object, as outlined in the previous point b), to direct marketing purposes through automated methods also extends to traditional methods and that, in any case, the data subject retains the possibility to exercise the right to object only in part. Therefore, the data subject may decide to receive communications only through traditional methods or only through automated communications or none of the two communication types. Where applicable, you also have the rights set out in articles 16-21 of the GDPR (right to rectification, right to be forgotten, right to restriction of processing, right to data portability, right to object), as well as the right to lodge a complaint with the supervisory authority.

To exercise the rights set out in art. 15 of the GDPR or for questions or information regarding the processing of your data and the security measures adopted, you can always send your request to our company at the following email address: privacy@preattoni.it.