Source: https://www.robertogiannotti.com/eng/roberto-giannotti/13/privacy-policy/
Timestamp: 2019-04-25 00:06:52+00:00

Document:
The personal data provided by users when completing the information request form belong to the category of common data, and do not include sensitive, health, genetic, biometric, judicial data, or data referred to in art. 9 and 10 of EU Regulation no. 2016/679, being not necessary the processing of these last categories of data for the achievement of the purposes pursued by the Holder. In any case, only personal data that are strictly necessary to the pursuit of specific and legitimate purposes, with respect to which the processing is always relevant and never excessive, will be processed.
The so-called "Browsing" data referred to in the previous art. 1.1 are acquired automatically by the software procedures used to operate the site. Personal data referred to in the previous art. 1.2 are provided by users of the site through the compilation of special electronic forms for requesting information on the pages of the aforementioned site.
Except as specified in the previous art. 1.1 with regard to the so-called “browsing” data, personal data provided by users of the site can be processed: to register on the site and enjoy the services offered by the Holder; to conclude purchases through the site and fulfill the related contractual obligations; for the implementation of the necessary accounting / administrative activities related to the purposes referred to in letters a) and b); for the fulfillment of obligations related to the purposes referred to in letters a) and b) provided for by law and by European Union’s regulations; for commercial, advertising, promotional and marketing purposes in a broad sense, which involve processings: e. 1) for the sending of communications of information relating to new offers of products and services, of a commercial nature and / or of commercial solicitation (Newsletters) by the Data Controller; e. 2) to carry out sales activities of the Data Controller's services; e. 3) for the sending of unsolicited commercial communications, immediately identifiable as such and containing the indication that the recipient can oppose the receipt of further communications of this kind.
The communication of the personal data requested in the various information collection forms present on the site and marked with an asterisk (*), which are indicated as mandatory data, even if it is remitted to the free will of the user, is necessary to achieve the specific purposes pursued by the Data Controller and related to the processing of this information. Consequently, the failure to communicate mandatory personal data will prevent from achieving the main purpose for which they are required. In particular, the communication of personal data marked with an asterisk (*) and requested in the information form of the "Cash desk" section is necessary for the conclusion of the contract of sale and the delivery of the product that the user wants to purchase. Therefore, failure to communicate these data will prevent from purchasing products through the site as well as the conclusion of any agreement with the Holder. While not communicating mandatory data, the user can still keep browsing the site. The communication of data other than those marked with an asterisk, which are indicated as elective, is left to the discretion of the user; as a consequence, the failure to communicate elective data will not produce any effects. Likewise, consent to the processing of personal data for marketing purposes referred to in art. 3 letter e) of the notice is purely optional. Therefore, failure to provide and consent to the related processing will not entail any effect for the user, except for the fact that the user will not receive the promotional and commercial communications indicated in art. 3 letter e). The Holder wants to inform the user that by giving consent to the processing of personal data for commercial, advertising, promotional and marketing purposes in a broad sense referred to in art. 3 letter d) the user authorises the processing of his own data: both through the "traditional" methods, such as: telephone calls with operator and contact by other non-electronic means or not supported by automatic or telematic procedures, and through automated and similar telephone calls such as: text messages and the like, systems supported by automated, electronic or telematic procedures, without operator; with reference to all the purposes indicated in art. 3 letter e), ie those indicated in letter e.1) and those indicated in letter e.2), and those indicated in letter e.3). In any case, the user has the right to request at any time to limit the processing of personal data for the purposes referred to in art. 3 letter e) to some of the above methods only (for example, only through "traditional" means) or to some of the types of processing indicated in letters e.1), e.2) and e.3) (for example, only the sending the Newsletters).
The legal basis of the processing of data for the purposes referred to in Article 3, letter a) and b) consists in the need to carry out specific activities requested by the user, in the need to conclude contracts with the user and fulfill the related obligations. With reference to these purposes, even if it is not compulsory, the Data Controller also requests the user's consent. The legal basis of the processing of personal data relating to the purposes referred to in Article 3 letters c) and d) consists, respectively, in the need to fulfill the contractual obligations assumed towards the user and in the fulfillment of legal obligations. The legal basis of the processing of personal data relating to the purposes referred to in Article 3 letter e) consists exclusively in the prior, free, specific, optional and informed consent to the processing for the aforementioned purpose. The legal basis of the processing of the browsing data consists in the legitimate interest of the holder in the need for the operation of the site.
The personal data provided by users of the site will be processed at the premises of the Holder, or in other places where the parties involved in the processing operate, through electronic and / or mechanical and analogical methods for the strictly necessary time to achieve the purposes for which they were collected and in any case not exceeding the limits indicated in this information notice, in full compliance with the purposes pursued by the Data Controller and in compliance with the current regulations on privacy. Specific security measures are observed to prevent data loss, illicit or incorrect use of the same and unauthorised access.
In compliance with current privacy legislation, the personal data of the user may be communicated to third parties to which the communication is necessary for the purposes of pursuing the objectives referred to in art. 3 letters a), b) and c) without the need to acquire separate consent. In accordance with art. 13 letter e) of EU Regulation no. 216/679, it is specified that the personal data of the Customer may be communicated to the following categories: the employees and collaborators of the Data Controller, appointed as Data Processors and specifically instructed in accordance with art. 29 of the EU Regulation no. 2016/679; individuals appointed as Data Processors or Data Protection Officers; third parties belonging to the following categories: offices, subjects and / or companies offering digital communication services, including hosting services, services related to website publishing, softwares’ design and development, or operating as suppliers of IT and logistical services functional to the operation of the site, as well as subjects and / or companies that carry out shipping services. Public Authority or any other third party if it is imposed by a legal obligation.
The Data Controller will not communicate the user's data to third parties for promotional or marketing purposes in the broader sense referred to in art. 3 letter e).
The Holder will not disclose and transfer the user's personal data outside the European Union or to international organisations.
Taken into account that the warranty provided by the civil law with reference to the sale of products to consumers is 2 years after the delivery of the goods sold, the personal data provided by the person concerned in order to purchase products through the site and to allow the holder to fulfill the related contractual and legal obligations, will be kept for a period not exceeding 2 years after the termination of the contractual relationship, unless prior request for cancellation by the person concerned. Personal data processed for promotional, commercial and marketing purposes in the broader sense referred to in art. 3, letter d), will be kept for a period not exceeding 12 months after the collection. Browsing data will be remaining for a period not exceeding one month. In any case, the terms of five or ten years of conservation of the documents and related data will be respected for the fulfillment of the civil, accounting and tax obligations required by the legislation in force, as well as for the protection of the rights of the holder in court.
The Data Controller will not submit the user's personal data to automated decision-making processes, including profiling.
The Data Controller makes available to users of the site the following e-mail address for the exercise of rights, also with reference to requests addressed to third parties to which the data have been communicated with the specific consent of the person concerned: pec robertogiannottisrl@legalmail.it. At the indicated offices of the Data Controller, the updated list of the appointed data processors is available.

References: art. 9
 art. 1
 art. 1
 art. 1
 art. 3
 art. 3
 art. 3
 art. 3
 art. 3
 art. 3
 art. 13
 art. 29
 art. 3
 art. 3