Policy on the processing of personal data (Article 13 of Regulation (EU) No. 2016/ 679)

Data controller

As required by Regulation EU 2016/679 (the “Regulation”), we inform you that your Personal Data will be processed by QUERCETTI & C. SPA headquartered in Turin at Corso Vigevano 25, as the Data Controller (“Controller”).

Types of data processed

The Controller will process your personal data (Article 4(1)) which includes, among other things, your name, surname and email address, for the purposes indicated below.

Purpose, legal basis, mandatory or optional nature of the data processing, data conservation period

Your personal data will be collected for the following purposes:

a) Management of registration on the website (e.g. creating a new customer account) and for the provision of services in the purchasing process (cart). In the private “User Profile” area, logged-in users can, among other things:

• Amend their personal data and manage their privacy settings (e.g. Revoke consent)
• Activities relating to website purchases (browsing order history, returns, managing delivery and billing addresses)

The legal basis for the data processing is the fulfilment of a contract to which the data subject is a party, or the execution of pre-contractual measures adopted at the request of the data subject (Art. 6.1.b. of the Regulation)

Your personal data will only be kept for the time necessary for the purpose for which it was collected, in accordance with the principle of minimisation (Article 5 paragraph 1c) of the GDPR. In any case, your personal data will be kept for the time necessary to manage the contract. The foregoing is subject to any further conservation of the data which may be required under the applicable laws, including the provisions of Article 2946 of the Italian civil code. Further information is available from the Controller.

The provision of your personal data for the above purposes is optional but if you do not provide it, it will not be possible to register on the website or fulfil the contract.

For the processing of data in the form of direct marketing or the sending of direct sales material, for market research or the sending of business communications relating to products or services of the Controller which are similar to those purchased, the Controller may, without the consent of the data subject, use the email and postal addresses given, within the limits permitted by Article 130 paragraph 4 of Legislative Decree 196/03 and the provision of the Italian Data Protection Authority of 19 June 2008.

The legal basis for the processing of your data for such purposes is Article 6 paragraph 1f) of the Regulation. The data subject may object to the data processing free of charge at any time upon first communication or thereafter, by sending an email to: privacy@quercetti.it

If in any case you wish to object to the processing of personal data for marketing purposes carried out using the means indicated above, or if you wish to revoke consent already given, you may do so at any time by contacting the Controller at the addresses indicated in this Policy, without affecting the legality of any data processing that was based on consent given before revocation.

The provision of your personal data for the above purpose is optional; there will be no consequences in the event of your refusal.

b) Fulfilment of legal obligations (e.g. management of product warranties)
The legal basis for the processing is the fulfilment of a legal obligation incumbent on the Controller (Article 6(1)(c) of the Regulation)
Your personal data will only be kept for the time necessary for the purpose for which it was collected, in accordance with the principle of minimisation (Article 5 paragraph 1c) of the GDPR. In any case, your personal data will be kept for the time necessary to manage the contract. The foregoing is subject to any further conservation of the data which may be required under the applicable laws, including the provisions of Article 2946 of the Italian civil code. Further information is available from the Controller.

c) Management of complaints (for example replies to complaints, reports or disputes)
The legal basis for the data processing is the fulfilment of a contract to which the data subject is a party, or the execution of pre-contractual measures adopted at the request of the data subject (Art. 6(1)(b) of the Regulation) and the fulfilment of a legal obligation incumbent on the Controller (Art. 6(1)(c) of the Regulation)
Your personal data will only be kept for the time necessary for the purpose for which it was collected, in accordance with the principle of minimisation (Article 5 paragraph 1c) of the GDPR. In any case, your personal data will be kept for the time necessary to manage the contract. The foregoing is subject to any further conservation of the data which may be required under the applicable laws, including the provisions of Article 2946 of the Italian civil code. Further information is available from the Controller.

d) Management of disputes
The legal basis for the processing is the pursuit of the legitimate interest of the Controller in order to defend rights in administrative or legal proceedings (Article 6(1)(f) of the Regulation)
Your personal data will only be kept for the time necessary for the purpose for which it was collected, in accordance with the principle of minimisation (Article 5 paragraph 1c) of the GDPR. In any case, your personal data will be kept for the time necessary to manage the contract. The foregoing is subject to any further conservation of the data which may be required under the applicable laws, including the provisions of Article 2946 of the Italian civil code. Further information is available from the Controller.

The provision of your personal data for the above purposes is optional but if you do not provide it, it will not be possible to fulfil the contract.

Your personal data will also be processed with your specific consent, for the following purposes:

e) the sending of promotional and marketing communications including newsletters and market research, using automated means (email) and non-automated means (ordinary post); the Controller will obtain a single form of consent for the marketing purposes described herein, in accordance with the General Provision of the Data Protection Authority “Guidelines on promotional activities and spamming” of 4 July 2013; if in any event you wish to oppose subject to the processing of your data for marketing activities carried out using the means indicated herein, or if you wish to revoke consent given, you may do so at any time by contacting the Controller at the addresses indicated in this Policy, without affecting the legality of any processing which was based on consent given before revocation. For generic marketing purposes your Personal Data will be kept for the period up until revocation of consent, and/or until the exercise of the right of objection and in any case, for no longer than 24 months from the date on which data was collected; before the expiry of that period the Controller may ask the user to renew consent and/or to update the data. Further information is available from the Controller.
The legal basis for the processing, for the purposes indicated in paragraph e) refers to the provision of consent by the data subject, to the processing of his/her personal data (art. 6(1)(a) of the Regulation)
The provision of your Personal Data for the purpose indicated in paragraph e) is optional; there will be no consequences in the event of your refusal

Recipients and transfer of the personal data

Your Personal Data may be shared with:

• persons authorised by the Controller for the processing of personal data, upon signature of a confidentiality agreement;
• contracted third parties: advisors and banks for accounting and administrative purposes; contractors, in the event that all or part of the works are outsourced to external firms, third parties involved in the management of information systems and websites, some of which will act as Data Processors (art. 28 of the Regulation). For a complete, up-to-date list of the data processors, please contact privacy@quercetti.it;
• persons, bodies or authorities who are required to be provided with your personal data in accordance with provisions of law, or orders by the authorities.

The Data Controller will not transfer your personal data outside of the European Economic Area.

Your privacy rights under Articles 15 et seq of the Regulation

You may at any time ask the Controller for access to your data, or for its rectification or erasure, the limitation of the data processing, the obtaining of the data relating to you in a structured, machine-readable format, in those cases provided for in Article 20 of the Regulation.

You may also, in accordance with Article 21 of the Regulation, object to the processing of the data on legitimate grounds, for example, to the sending of direct marketing via automated means (text or video messages, emails, push notifications or faxes) or non-automated means (post, phone calls performed by phone operators), including profiling; you may also exercise this right in part, for example by objecting only to the sending of promotional communications using automated means. You may at any time, under Article 7 of the Regulation, revoke consent already given, without affecting the legality of any data processing carried out prior to revocation.

Requests must be sent in writing to the Controller at the following address privacy@quercetti.it

In any case, the data subject may at any time make a complaint to the relevant regulatory body (Italian Data Protection Authority) in accordance with Article 77 of the Regulation, if he or she considers that his or her personal data has been processed in breach of the current laws.