PURSUANT TO REGULATION (EU) 2016/679 ON THE PROTECTION OF PERSONAL DATA (“G.D.P.R.”)
PREMISE
Dear Customer/User, in accordance with the obligations imposed by Regulation (EU) 679/2016 (General Data Protection Regulation – aka G.D.P.R.) BFC S.r.l. (hereinafter referred to as “COMPANY”), intends to inform you on how your personal data is processed, to request your consent where this is necessary and to make you aware of your rights as well as of the methods to be able to exercise them easily.
DATA CONTROLLER AND CONTACT DATA
The data controller is BFC S.r.l. with registered offices in Via Bachelet number 10 in GAZZO (PD) Italy, tax code and Vat reg. no. 03149650164, Padua REA no. 349585, info@ducadisangiusto.it
TYPE OF DATA PROCESSED
The COMPANY, in order to be able to provide you with what is requested and to be able to pursue the purposes better described in the specific dedicated paragraph, also by reason of any consent given, processes several types of personal data (including but not limited to personal data, address, telephone numbers, e-mail addresses, etc.).
SOURCES OF COLLECTION OF PERSONAL DATA
The COMPANY collects personal data concerning you solely and directly from you, including in its own stores. You can provide us with your personal data when requesting information, quotes, during negotiations, when signing contracts or during their development, during your visit to our store, when purchasing our products as well as, in general, at the time of requesting the provision of services, however qualified or named.
PROCESSING METHODS
Your personal data is processed both manually, in paper format and through electronic and IT tools, with logic strictly related to the purposes indicated. Your personal data can be entered in our management systems and in a Customer Relationship Management system (C.R.M.), where your personal and contact data is entered in any case. In the presence of specific consents, the data entered in the C.R.M. may also be processed for the further purposes better specified below. In any case, your personal data is protected by means of adequate technical and organizational measures, in order to guarantee its security and confidentiality, in compliance with the regulations in force. The COMPANY has implemented specific security measures to prevent the loss or destruction of data, unauthorized access, processing that is not permitted or does not comply with the purposes for which it was collected.
PURPOSES OF THE PROCESSING AND LEGAL BASES
The COMPANY processes personal data for multiple purposes, some of which require your specific and optional consent. To facilitate your understanding and ensure greater clarity, we have deemed it appropriate to explicitly distinguish the individual purposes, as detailed below:
a. operational management purposes (PRIMARY PURPOSES): with this term we mean the performance of all those activities strictly functional to meeting your requests, both in the pre-contractual phase and to execute a specific contract of which you are a part, as well as for all activities connected or instrumental to these, functionally linked to the operations of the COMPANY or to the protection of its rights. These purposes include all the activities necessary to provide you with the information, assistance, services or products requested or of your interest, which for greater clarity are listed hereinafter and include without limitation: the management of negotiations or the pre-contractual phase; the negotiation and conclusion of the contract or an order; the provision of services and/or services requested in general; the fulfilment of administrative and accounting obligations; payment management; the stipulation of insurance, including through third parties; assistance and support, including after sales; the management of any complaints. We furthermore believe that they are connected and instrumental to these activities, for example: insurance purposes; verification of internal quality through assessments, controls and audits, including by third parties; carrying out audits, including by third parties, aimed at ensuring compliance with current legislation on the processing of personal data; the fulfilment of legal, accounting, tax, administrative obligations deriving from law, regulation or community legislation; credit recovery; credit risk protection; the protection of company assets; the protection of the rights of the COMPANY in court or in the most appropriate places. The aforementioned handling is lawful since it is necessary for the execution of a contract of which you are a party or for the execution of pre-contractual measures adopted at your request, to allow the COMPANY to fulfil a legal obligation to which it is subject or, finally, to your legitimate interest, such as for example the exercise and protection of your rights. As better explained in the dedicated paragraph below, the processing of any particular data is carried out by virtue of your explicit consent and such data may also be used, where strictly necessary, for the protection of the Company’s rights.
b. subject to your consent, your data is processed for marketing purposes and customer loyalty, i.e. for sending, even on a periodic basis (e.g. newsletters), advertising material, direct sales, commercial and promotional communications, including the sending of communications relating to goods, services, accessories, own or third party products, events and initiatives promoted by the COMPANY, both by telephone and by means of electronic communication. Unless you express a different preference, this can take place either through Traditional Contact Methods, such as sending paper mail and telephone calls, or by e-mail, even of a periodic nature (Newsletter), text messages (SMS-Short Message Service), instant messaging systems (including chat and social networks or other types of IT platforms and tools/channels). It is hereby specified that any subsequent opposition for the use of Automated Contact Modes automatically extends to Traditional ones as well, without prejudice to the possibility of exercising this right only in part (only for the Automated Modes or some of them), with the methods better specified in the following paragraph “Rights of the interested party”.
WITHDRAWAL OF CONSENT
If you have given consent to authorize a specific processing, we inform you that you can withdraw it at any time by contacting the Data Controller in the manner indicated in the following paragraph “Rights of the interested party”. This withdrawal, in any case, does not affect the lawfulness of processing based on the consent given before the withdrawal. In case of withdrawal of consent, personal data may in any case be processed if there is a different legal basis that legitimizes its processing.
PROVISION OF DATA AND CONSEQUENCES OF ANY REFUSAL
The provision of your personal data is always left to your free will. However, the provision of personal data for Primary Purposes, even of a particular nature, if necessary, is required and indispensable to allow the COMPANY to meet your requests. Failure to provide personal data may therefore make it impossible for the COMPANY to initiate pre-contractual negotiations/relationships, to establish contractual relationships, to manage the post-contractual phase and/or, in any case, to provide you with the services or the required performance. The provision of your personal data is, however, absolutely free and optional for Marketing Purposes. Failure to provide your personal data for one or more of the aforementioned purposes will have no consequence for you, other than the impossibility for the COMPANY to carry out what is better described above.
DISCLOSURE OF DATA AND ITS COMMUNICATION
Your personal data is processed by persons specifically authorized or designated by the Data Controller within its structure (employees and collaborators, however named), by reason of the performance of the duties and tasks assigned to each.
Your personal data may also be processed by other external parties operating on behalf of the COMPANY by virtue of specific contractual obligations or, in any case, duly authorized or appointed as data processors. By way of example, where necessary, your personal data may be processed by: IT, telematic and technological service providers, including hosting and maintenance services; commercial partners of the COMPANY; maintenance, updating and development service providers of websites and related functionalities; subjects that deal with the printing, transmission, enveloping, transport and sorting of communications; subjects that deal with document archiving and conservation; subject to your consent for Marketing Purposes, companies specialized in marketing and commercial information activities. The updated list of authorized data processors is available on site and can be consulted upon request.
For the pursuit of the Primary Purposes, your personal data, also of a particular nature (where strictly necessary), may, if required, be disclosed to the following categories of recipients: factoring companies; banks and credit institutions; debt collection companies; credit insurance companies; insurance companies, brokers and other entities in the insurance sector; long-term leasing or rental companies; financial companies; commercial information, detection and analysis of financial risks/customer solvency and fraud prevention companies; professionals, experts, consultants, firms or consultancy companies in the administrative, insurance, accounting, tax, technical and legal fields; sector and/or industry associations; companies operating in the shipping and transport sector.
We inform you that your personal data may in any case always be disclosed to third parties, public and private, to comply with legal obligations, to comply with orders from public authorities or to exercise a right in court or in any other location.
Your personal data is not transferred and is not subject to disclosure.
TRANSFER OF DATA ABROAD
The COMPANY mainly processes its data within its headquarters or, in any case, within the E.U. and/or the European Economic Area. Also by virtue of the IT applications used, if necessary, the COMPANY may transfer your personal data to third countries. In any case, we assure you that the transfer and processing of your personal data takes place in compliance with the conditions imposed by the G.D.P.R. (Article 44 et seq.), such as the Commission’s adequacy decisions, standard contractual clauses or other guarantees considered adequate.
DURATION OF THE PROCESSING
In accordance with the laws on the preservation of accounting documents and with the general rules on the ordinary limitation period for contractual actions, we will delete your personal data relating to the Primary Purposes after a period of ten years, starting from the time of termination of the contract or formulation of the offer.
Personal data processed for additional optional purposes (Marketing Purposes) will be deleted after 10 years, a term deemed appropriate, also considering the sector statistics.
We remind you that in the event of withdrawal of the consent given for a specific purpose, the COMPANY will no longer use your personal data for these purposes but may still store and process it where necessary for the primary purposes or to protect the interests of the COMPANY from possible liability based on such handling.
RIGHTS OF THE DATA SUBJECT
In application of the G.D.P.R., as “data subject” you can exercise the following rights at any time, where and as applicable. In application of the G.D.P.R., we inform you that you can exercise the following rights at any time:
- obtain confirmation as to whether or not personal data concerning you is being processed and, in this case, obtain access to personal data and all information provided for by Article 15 of the G.D.P.R., possibly obtaining a copy where this does not bind the rights and freedoms of others;
- obtain the correction of inaccurate personal data concerning you without undue delay. Taking into account the purposes of the processing, you have the right to obtain the integration of incomplete personal data, also by providing an additional declaration;
- obtain the cancellation of personal data concerning you without undue delay;
- obtain the limitation of processing whenever one of the hypotheses provided for by Article 18 of the G.D.P.R . occurs;
- data portability, i.e. receiving the personal data concerning you provided to the undersigned COMPANY in a structured format, commonly used and readable by an automatic device;
– not be subjected to a decision based solely on automated processing, which produces legal effects concerning you or which significantly affects your person in a similar way. This right does not apply in cases governed by Article 22, paragraph 2 of the G.D.P.R.
You can exercise the above rights by contacting the COMPANY at any time. In order to manage your requests properly, we invite you to write to us by registered mail or by sending an email to the following address: info@ducadisangiusto.it. It will be our responsibility to verify that you are entitled to exercise your rights and we will, as a rule, reply to you within one month.
We remind you that you can request cancellation from the periodic commercial communications sending service to the addresses provided by you. The request to deactivate and unsubscribe from the Newsletter Service can be made by the interested party at any time. Where technically possible, the COMPANY allows you to exercise this right directly without the need to send specific communications, for example, by clicking the link at the bottom of the text (“Unsubscribe” or other equivalent form) present in the messages sent by e-mail.
RIGHT TO OBJECT
In compliance with the requirements of Article 21, paragraph 4 of the G.D.P.R., the COMPANY brings your right to object to your attention. In particular, you will have the right to:
- object at any time, for reasons connected to your particular situation, to the processing of personal data concerning you pursuant to Article 6, paragraph 1, letters e) (execution of a task of public interest or connected to the exercise of public powers) or f) (legitimate interest) of the G.D.P.R. In this case, the COMPANY will refrain from further processing personal data unless there are compelling legitimate reasons to proceed with the processing that prevail over the interests, rights and freedoms of the data subject or for the assessment, exercise or defense of a right in court;
- object at any time to the processing of personal data concerning you carried out for direct marketing purposes, including profiling to the extent that it is connected to such direct marketing. In this case, the personal data is no longer processed for these purposes.
You can exercise your right to object by contacting the COMPANY at any time. In order to manage your requests properly, we invite you to write to us by registered mail or by sending an e-mail to the following address: info@ducadisangiusto.it
RIGHT TO LODGE A COMPLAINT
Furthermore, if you believe that the data processing carried out by the COMPANY is illegitimate, you can lodge a complaint with the competent supervisory authority.
CHANGES AND UPDATES
As the regulatory framework is constantly evolving, it will be our responsibility to notify you of any changes or updates to this information through the same channels used to contact you. We trust that you will appreciate our commitment to transparency and our willingness to make you fully aware of what we do with your personal data.
