Information on the processing of personal data pursuant to Article 13 et seq. of EU Regulation 679/2016

Alfonso Fornasieri, as Data Controller (hereinafter also referred to as “Controller” or “Company”) pursuant to EU Regulation 679/2016 (hereinafter referred to as the “GDPR”) and subsequent amendments to Legislative Decree 196/2003 (hereinafter referred to as the “Privacy Code”) – invites you, before communicating any personal data to the Controller, to carefully read this Privacy Policy as it contains important information on the protection of your personal data.

This Privacy Policy:

is intended for the website www.fornasieriabbigliamento.it (hereinafter: “Site”), as well as for requests, information and services that may be requested by telephone on 011/727449 or via email at info@fornasieriabbigliamento.com;
forms an integral part of the Site and the services we offer,
is provided in accordance with Article 13 et seq. of the GDPR and the Privacy Code to those who interact with the web services of the Site or who contact the Company by telephone, post or email.

_

The processing of your personal data will be guided by the principles of fairness, lawfulness, transparency, purpose and storage limitation, minimisation, accuracy, integrity and confidentiality, as well as the principle of accountability referred to in Article 5 of the GDPR.

Your personal data will therefore be processed in accordance with the legislative provisions of the GDPR and the confidentiality obligations therein, as well as those of the Privacy Code still in force today.

By personal data processing, we mean any operation or set of operations, performed with or without the aid of automated processes and applied to personal data or sets of personal data, such as collection, registration, organisation, structuring, storage, adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other form of making available, comparison or interconnection, limitation, erasure or destruction, as defined in Article 4.2 of the GDPR.

We inform you that the personal data undergoing processing may consist of – depending also on your decisions on how to use the services – any information concerning you that is suitable for making you identified or identifiable, including textual information, photographic images or videos, and any other information provided.

INDEX

Below we provide the index for this Privacy Policy so that you can easily find the information concerning the processing of your personal data that interests you.

1. DATA CONTROLLER: WHO WE ARE AND WHAT WE DO
2. WHAT DATA WE PROCESS
3. Navigation data
4. Data provided voluntarily by You – Special Categories of Data
5. Third-party data provided voluntarily by you
6. Cookie
7. REASONS WE PROCESS YOUR DATA – PURPOSES OF PROCESSING
8. LEGAL BASIS AND MANDATORY OR OPTIONAL NATURE OF THE
9. TREATMENT
   RECIPIENTS OF PERSONAL DATA
10. TRANSFERS OF PERSONAL DATA
11. PERSONAL DATA CONSERVATION
    RIGHTS
12. OF THE INTERESTED PARTY
13. CHANGES
14. Contact details

1. DATA CONTROLLER: WHO WE ARE AND WHAT WE DO

The data controller is Alfonso Fornasieri, in his capacity as owner of the company of the same name, VAT number 07321570017, located at Corso Peschiera n. 291/H, Turin, which is involved in the retail sale of clothing.

2. WHAT DATA WE PROCESS

We inform you that the personal data being processed may consist of an identifier such as a name, an identification number, location data, an online identifier or one or more elements characteristic of your physical, physiological, genetic, psychological, economic, cultural or social identity suitable for identifying or making the data subject identifiable, depending on the type of services requested (hereinafter referred to as “personal data”).

The personal data processed through the Website are the following:

3. Navigation data

The computer systems and software procedures responsible for the operation of the Site acquire, in the course of their normal functioning, certain personal data whose transmission is implicit in the use of Internet communication protocols. This is information that is not collected to be associated with identified data subjects, but which by its very nature could, through processing and association with data held by third parties, allow users to be identified. This category of data includes IP addresses or domain names of the computers used by users connecting to the Site, the addresses in URI (Uniform Resource Identifier) notation of the requested resources, the time of the request, the method used in submitting the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.), and other parameters relating to the user's operating system and IT environment. This data is used solely for the purpose of obtaining anonymous statistical information on the use of the Site, to monitor its correct functioning, to identify anomalies and/or abuses, and is immediately deleted after processing. The data could be used to ascertain responsibility in the event of hypothetical computer crimes against the Site or third parties.

4. Data provided voluntarily by you – Special Data

Save for specific information notices, this Privacy Policy is also intended for the processing of data voluntarily provided by you via email and/or telephone and/or through the “Fidelity Card” form and/or in the “Contacts” section on the Website. In this regard, we invite you not to communicate information that may fall into the categories of special personal data referred to in Article 9 of the GDPR (for example, data relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sexual life/orientation, as well as genetic data, biometric data or data relating to your state of health), unless expressly requested and subject to specific information and any consent.

5. Third-party data provided voluntarily by you

In the use of certain services, personal data of third parties, communicated by you to the Company, may be processed. With respect to these scenarios, you act as the independent data controller, assuming all legal obligations and responsibilities. In this regard, you provide the broadest indemnity against any dispute, claim, demand for damages from processing, etc., that may be made against the Data Controller by third parties whose personal data has been processed through your use of the Website's services in violation of applicable data protection regulations. In any event, should you provide or otherwise process third-party personal data in your use of the Website, you guarantee from now on – assuming all related responsibility – that such processing is based upon your prior acquisition of the third party's consent for the processing of their information and its dissemination, and that such processing by you will be carried out in compliance with the GDPR.

6. Biscuit

Information about the cookies served by the Site is available at the following address http://www.fornasieriabbigliamento.it/content/3-Cookies

7. WHY WE PROCESS YOUR DATA - PURPOSES OF PROCESSING

Your personal data will be processed, with your consent where necessary, for the following purposes, where applicable:

3.1. to allow browsing of the Site and the provision of the Company's services through the Site;

3.2. encountering specific requests, including by phone and/or email, directed at the Company;

3.3. complying with any obligations provided for by current laws, regulations, or EU legislation, or satisfying requests from authorities;

3.4. exercise the Data Subject's rights;

3.5. fulfilling contractual and pre-contractual obligations arising from our relationship with you;

3.6. carry out direct marketing via email, post, SMS, if you have given your consent to receive such communications and, therefore, to send you informative/promotional/commercial material relating to the Company's activities and products.

Your personal data, including that which falls within the category of special data, will be processed using automated and non-automated tools.

Specific security measures are observed to prevent data loss, illicit or incorrect use, and unauthorised access.

8. LEGAL BASIS AND MANDATORY OR OPTIONAL NATURE OF THE PROCESSING

The legal basis for the processing of personal data for the purposes referred to in Sections 3.1, 3.2 and 3.5 is Article 6(1)(b) of the GDPR ([...] processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract), as the processing is necessary for the provision of services. The provision of personal data for these purposes is optional, but any failure to provide it would make it impossible to activate the requested services.

The legal basis for the purpose referred to in section 3.3 is Article 6(1)(c) of the GDPR ([...] processing is necessary for compliance with a legal obligation to which the controller is subject). Once personal data has been provided, processing is indeed necessary to comply with legal obligations to which the Company is subject.

The legal basis for the purpose referred to in section 3.4 is Article 6(1)(f) of the GDPR (....Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject...), in order to establish, exercise or defend a legal claim. This processing is also necessary if the above-mentioned requirements are met.

The legal basis for the purposes referred to in section 3.6 is the release of your consent pursuant to Article 6(1)(a) ([...] the data subject has given consent to the processing of his or her personal data for one or more specific purposes) and Article 22(2)(c) of the GDPR. The provision of your personal data for these purposes is therefore entirely optional and does not affect the enjoyment of the services. Should you wish to object to the processing of your data for marketing purposes, you may do so at any time by contacting the Data Controller using the contact details indicated in the “Contacts” section of this privacy notice. Please note that if the data controller uses the email addresses provided by the data subject in the context of the sale of a product or service for the direct sale of its own products or services, it may not request the data subject's consent, provided that the services are similar to those covered by the sale and the data subject, having been duly informed, does not refuse such use, either initially or on the occasion of subsequent communications.

9. RECIPIENTS OF PERSONAL DATA

Your personal data may be shared, for the purposes referred to in Section 3 of this Privacy Policy, with:

5.1. Data processors, meaning: i) individuals, companies, or professional firms providing assistance and consultancy services to the Company in accounting, administrative, legal, tax, and financial matters, or other business consultancy; ii) credit institutions; iii) entities appointed to carry out technical or IT maintenance activities; iv) Cinevision S.r.l. as the provider of the Smsmobile service (collectively, the “Recipients”);

5.2. entities, bodies or authorities to whom your personal data must be communicated by law or by order of the authorities;

5.3. individuals authorised by the Company to process personal data necessary to carry out activities strictly related to the provision of services, who have undertaken to maintain confidentiality or have an appropriate legal obligation of confidentiality, and who guarantee the Data Processing in compliance with the GDPR.

10. TRANSFER OF PERSONAL DATA

Personal data is stored on servers located within the European Union. However, it is understood that the Data Controller shall have the option to move the servers outside the European Economic Area if necessary. In such a case, the Data Controller hereby assures that such transfer will take place in compliance with applicable legislation, based on an adequacy decision or the Standard Contractual Clauses approved by the European Commission. Further information is available by sending a written request to the Data Controller at the contact details indicated in the “Contacts” section of this privacy policy.

11. PERSONAL DATA RETENTION

Personal data processed for the purposes referred to in Section 3 will be retained for the time strictly necessary to achieve those same purposes and, as these are processing activities carried out for the provision of services, until the period of time provided for and permitted by Italian law to protect the Company's interests and right of defence, taking into account the limitation periods provided for by the applicable legislation.

Further information regarding the data retention period and the criteria used to determine this period can be requested by sending a written request to the Data Controller at the contact details indicated in the “Contacts” section of this notice.

12. DATA SUBJECT RIGHTS

In your capacity as the Data Subject, pursuant to Articles 15 et seq. of the GDPR, you have the right to:

obtain confirmation of the existence or otherwise of personal data concerning you, even if not yet registered, and their communication in an intelligible form;
to obtain indication: a) the origin of personal data; b) the purposes and methods of processing; c) the logic applied in the case of processing carried out with the aid of electronic instruments; d) the identification details of the data controller, the data processors and the representative appointed pursuant to Article 3, paragraph 1, of the GDPR; e) the individuals or categories of individuals to whom the personal data may be communicated or who may become aware of them as designated representative within the territory of the State, as data processors or persons in charge;
obtain: a) the updating, rectification or, where in your interest, integration of your data; b) the cancellation, anonymisation or blocking of data processed in violation of the law, including data that does not need to be kept for the purposes for which it was collected or subsequently processed; c) confirmation that the operations referred to in points a) and b) have been brought to the attention, also as regards their content, of those to whom the data were communicated or disseminated, except where this proves impossible or involves the use of means clearly disproportionate to the right protected;
to object, in whole or in part: a) to the processing of personal data concerning you, even if relevant to the purpose of collection; b) to the processing of personal data concerning you for the purpose of sending advertising material or direct sales or for market research or commercial communication, by automated call systems without the intervention of an operator, by e-mail and/or by traditional marketing methods by telephone and/or post. Please note that the data subject's right to object, as set out in point b) above, for direct marketing purposes by automated methods extends to traditional methods and that, in any case, the data subject may still exercise the right to object even if only in part. Therefore, the data subject may decide to receive only communications by traditional methods or only automated communications or neither type of communication.
Where applicable, you also have the rights under Articles 16-22 of the GDPR (right to rectification, right to erasure, right to restrict processing, right to data portability, right to object, right to object to automated processing, including profiling).

Requests should be made in writing to the Data Controller at the contact details provided in the “Contacts” section of this notice.

In any case, you always have the right to lodge a complaint with the competent supervisory authority (Garante per la protezione dei dati personali), pursuant to Article 77 of the GDPR, if you believe that the processing of your data is contrary to the current legislation.

CHANGES

The Company reserves the right to modify or simply update the content of this Privacy Policy, in part or in full, also due to changes in applicable legislation. In such cases, these changes will be binding as soon as they are published on the Website. The Company therefore invites you to visit this section regularly to familiarise yourself with the most recent and updated version of the Privacy Policy so that you are always informed about the data collected and how it is used by the Data Controller.

Contact details

To exercise the above rights or for any other requests, you can write to the Data Controller: Alfonso Fornasieri, in his capacity as the owner of the sole proprietorship of the same name, VAT number 07321570017, located at Corso Peschiera n. 291/H, Turin, which is involved in the retail sale of clothing, email amministrazione@fornasieriabbigliamento.it