Source: https://www.pandasafety.com/privacy-policy/
Timestamp: 2019-04-23 06:13:16+00:00

Document:
The data controller is Calzaturificio Panda Sport s.r.l., with registered offices in C.da Colucci, 154, 72014 Cisternino.
fulfilment of the obligations required by law, regulations, applicable rules and other provisions issued by authorities entitled to do so by law and by supervisory and control bodies.
The processing of the personal data for the purposes indicated above does not require your express consent (art. 24, letter a) and b) of the Code and art. 6 letter b) and e) of the GDPR).
carrying out promotional and marketing activities of the Data Controller’s products and services, commercial communications using both automatic means without operator intervention (e.g. SMS, fax, MMS, email etc.) and traditional ones (by telephone, post).
preparing studies and market research.
The processing of the personal data for the purposes indicated above does not require your express consent (art. 23 of the Code and art. 7 of the GDPR). This consent concerns both the manner of automatic communication and the traditional ones described above. You will always be entitled to easily and freely oppose, wholly or even only partially, the processing of your data for these purposes, by, for instance, excluding automatic contact methods and expressing your will to receive commercial and promotional communications exclusively through traditional contact methods.
Disclosure of the data requested for the purposes indicated in the previous letters a) and b) is mandatory for fulfilling legal obligations and/or for concluding and executing the contractual relationship and providing the services requested. Therefore, any refusal, even partial, of providing these data would mean the impossibility for the Supplier to establish and manage the relation itself and to provide the requested service.
Disclosing the personal data necessary for the purposes indicated in the previous letters c) and d) is discretionary, therefore, any refusal to provide this data would make it impossible to implement the activities described herein.
The personal data is processed by means of the operations indicated in art. 4 of the Privacy Code and art. 4 no. 2) of the GDPR, for the purposes indicated above, both on paper and in file format, by means of electronic instruments or anyway automated ones, in respect of the laws in force in particular regarding confidentiality and safety and in conformity with the principles of fairness, lawfulness and transparency and protecting the Customer’s rights.
The processing is carried out directly by the data controller’s organisation, by its data processors and/or assigned personnel.
natural and/or legal persons who provide services instrumental to the activities of the Data Controller for the purposes laid down in the previous point 1. (e.g. call centres, suppliers, consultants, companies, authorities, professional offices). These subjects will operate in their capacity of data processors.
The personal data will in no way be subject to dissemination.
The personal data will be kept for the whole duration expressed by the contract stipulated with the Data Controller, after which the data will be retained until the end of the term provided for by law for keeping administrative documents, after which they will be deleted.
The personal data will be kept on servers located within the European Union. In any case, it is agreed that the Data Controller will, if necessary, be entitled to move them to servers even outside the EU. In this case, the Data Controller hereby assures that the transfer of the data outside the EU will be carried out in conformity with the applicable legal provisions, subject to stipulating the standard contractual clauses envisaged by the European Commission.
obtaining confirmation as to whether or not personal data concerning you exist, regardless of their being already recorded, and communication of such data in intelligible form.
obtaining the indication: a) of the origin of the personal data; b) of the purposes and manner of processing; c) of the logic applied in the event of processing performed with electronic instruments; d) of the identification of the data controller, of the data processors and of the controller’s representative designated pursuant to art. 5(2) of the Privacy Code and art. 3 (1) of the GDPR; e) of the entities or categories of entity to whom the personal data may be disclosed or who may become aware of said data in their capacity as designated representative in the State’s territory, of data processors or assignees.

References: art. 6
 art. 7
 art. 4
 art. 4
 art. 5
 art. 3