Privacy policy
CUSTOMER INFORMATION
Pursuant to Article 13 of Regulation (EU) 2016/679 on the protection of personal data
Dear Customer,
in accordance with the Regulation on the protection of individuals with regard to the processing of personal data and on the free movement of such data (EU Regulation of the European Parliament and of the Council of 27 April 2016, no. 2016/679/EU, hereinafter referred to as GDPR), we wish to inform you that the data controller processes your data for the purposes set out below, in compliance with the legislation on the protection of personal data.
DATA CONTROLLER
The Data Controller (hereinafter referred to as DATA CONTROLLER) is Bellaeterea di Enrica Di Corrado, with registered office in Santa Maria della Versa, frazione Villanova 13A, 27047 (PV), VAT no. 02942670189 e mail address carine@bellaeterea.com.
PURPOSE AND LEGAL BASIS FOR PROCESSING
Personal data such as name and surname, tax code, e-mail address, telephone number are collected to:
a. allow registration on the site necessary to provide the services offered. Legal basis: the processing is necessary for the performance of a contract and pre-contractual measures (Art. 6.1, letter b, GDPR)
b. enabling users to place product orders on the site. Legal basis: processing is necessary for the performance of a contract and pre-contractual measures (Art. 6.1(b) GDPR)
c. provide assistance in relation to the products purchased. Legal basis: processing is necessary for the performance of a contract and pre-contractual measures (Art. 6.1(b) GDPR)
d. to fulfil any tax and accounting obligations. Legal basis: processing is necessary for compliance with a legal obligation (Art. 6.1(c) GDPR)
e. to fulfil obligations required by law, regulations, EU legislation or an order from the Authority (such as anti-money laundering). Legal basis: processing is necessary to fulfil a legal obligation (Art. 6.1(c) GDPR)
f. marketing purposes, i.e. sending commercial communications and/or advertising material on products offered by the data controller that may be of interest to you. legal basis: explicit consent of the data subject (Art. 6.1, letter a, GDPR)
OBLIGATION AND OPTIONALITY OF PROVIDING DATA
The provision of data is compulsory and any refusal to provide even partial data will make it impossible to establish and/or continue any business relationship with the owner.
RECIPIENTS OF THE DATA
The data may be communicated to third parties, for technical and operational requirements strictly related to the purposes set out above and, in particular, to the following categories of subjects
- parties providing services for the smooth operation of the site (e.g. sending e-mails)
- professionals or companies in connection with the fulfilment of administrative and accounting obligations;
- banks and financial institutions for the performance of contractual obligations undertaken with customers;
- suppliers of assistance and maintenance services for computer and telematic systems and all the services functionally connected and necessary for the fulfilment of the services covered by the contract.
METHODS OF PROCESSING
The processing of data for the above-mentioned purposes takes place through the use of electronic media, in compliance with the rules of confidentiality and security provided for by law, consequent regulations and any internal provisions.
DATA RETENTION TIMES
The owner will keep the data for a period of time not exceeding the achievement of the purposes for which they were collected. Data strictly necessary for tax and accounting purposes will be kept for a period of 10 years as required by the relevant regulations. Data processed for marketing purposes (as per point f.) will be kept for 24 months, unless consent is revoked in advance.
TRANSFER OF DATA TO COUNTRIES OUTSIDE THE EU
The controller does not transfer personal data to third countries or to international organisations. However, it reserves the right to use cloud services, in which case the service providers will be selected from among those who provide adequate guarantees in accordance with Applicable Law.
RIGHTS OF THE DATA SUBJECT
In your capacity as Data Subject and in relation to the processing operations described in this Policy, you may exercise the following rights by sending an e-mail to carine@bellaeterea.com:
- Right of access i.e. the right to obtain confirmation as to whether or not personal data concerning you are being processed and, if so, to obtain access to such personal data, including a copy thereof;
- Right of rectification i.e. the right to obtain, without undue delay, the rectification of inaccurate personal data concerning him/her and/or the integration of incomplete personal data;
- Right to erasure (right to be forgotten) i.e. the right to obtain, without undue delay, the deletion of personal data concerning him/her, if one of the following grounds applies: personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;personal data must be erased in order to comply with a legal obligation under Union or Member State law to which the Data Controller is subject;
- Right of restriction of processing i.e. the right to obtain the restriction of processing, when: the data subject disputes the accuracy of the personal data, for the period necessary for the Data Controller to verify the accuracy of such data; the processing is unlawful and the data subject objects to the deletion of the personal data and requests, instead, that its use be restricted; the personal data is necessary for the establishment, exercise or defence of a legal claim; the data subject has objected to the processing pursuant to Art. 21 GDPR, during the period pending verification as to whether legitimate reasons of the Data Controller prevail over those of the data subject;
- Right to data portability i.e. the right to receive, in a structured, commonly used and machine-readable format, personal data concerning you and the right to transmit them to another Data Controller without hindrance, if the processing is based on consent and is carried out by automated means. Furthermore, the right to have your personal data transmitted directly to another Data Controller if this is technically feasible;
- Right of objection i.e. the right to object, at any time, to the processing of your personal data.
- Right of complaint i.e. the right to lodge a complaint with the Data Protection Authority, following the procedures and indications published on the Authority's official website www.garanteprivacy.it