Terms and Privacy

PRIVACY POLICY ON THE PROCESSING OF PERSONAL DATA PURSUANT TO ART. 13 OF EU REGULATION NO. 2016/679 (GDPR)

 

1. IDENTITY AND CONTACT DETAILS OF THE DATA CONTROLLER

The Data Controller is Ditta Artigianale s.r.l. (VAT No. 06445470484), with registered office in Florence, via dei Neri 30r – 32r, postcode 50122, represented by its legal representative pro tempore, Mr Francesco Sanapo, whose contact details are as follows:

- tel. 055 274 1541

- e-mail: francesco@dittaartigianale.it

- address: via dei Neri 30r – 32r, 50122 Florence.

The Data Controller has not appointed a Data Protection Officer (DPO).

 

2. PERSONAL DATA SUBJECT TO PROCESSING

Within the limits of the purposes and methods defined in this privacy policy, the personal data voluntarily provided to the Data Controller are subject to processing, namely contact details such as first name, surname, address, e-mail, telephone number, tax code and VAT number, images, authentication credentials, and any additional information sent, including when contacting customer support.

Data acquired automatically for the normal operation of the website are also processed, such as the IP addresses or domain names of the computers used by users connecting to the website, the URI (Uniform Resource Identifier) addresses of the requested resources, the request, the method used to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the response provided by the server (successful, error, etc.), and other parameters relating to the user's operating system and IT environment. These are pieces of information which, by their very nature, could, through processing and association with data held by third parties, make it possible to identify the computers connecting to the website.

The Data Controller may also receive information relating to the Data Subject from other sources, such as couriers, concerning updated delivery and address information, which may be used and/or processed to deliver future orders more easily.

 

3. COOKIES

The website uses cookies and other similar technologies both in the form essential for its operation (technical cookies, information without which the website cannot function) and for the purposes of personalizing browsing, marketing, and statistics (in this case, in anonymous form). They are stored and then transmitted during the Data Subject's subsequent visit. The complete Cookie Policy can be viewed via the link in the footer.

 

4. PURPOSES AND LEGAL BASIS FOR DATA PROCESSING

The data provided by the Data Subject during or in connection with purchases made by them on the Website will be processed by the Data Controller in order to receive and manage orders, provide the products and/or services purchased, process payments, and send the Data Subject communications relating to their orders and the products. For these purposes, processing is based on art. 6.1(b) of the GDPR, as it is necessary for the performance of a contract to which the Data Subject is a party. Failure to provide the data for these purposes prevents the contractual relationship from being concluded and performed.

The data provided by the Data Subject may also be processed:

- for managing the Data Subject's personal account;

- for communications, support, and contact with the Data Subject, or to respond to their requests;

- for marketing purposes, including through newsletters, in relation to the Data Controller's products and/or services;

- to conduct market research using automated and traditional methods.

In the cases listed above, providing data by the Data Subject is voluntary (and is therefore based on art. 6.1(a) of the GDPR). The Data Subject may choose not to provide their data, but in that case Ditta Artigianale may be unable to satisfy all or part of their requests.

The Data Subject's Personal Data may also be used by the Data Controller to protect its interests in legal proceedings before the competent courts and to comply with any obligation required by applicable regulations, laws, and rules, including tax and fiscal obligations.

The use of the Data Subject's data for any other purposes will be subject to a specific request for consent.

 

5. PROCESSING METHODS

Personal data may be processed using both paper and electronic records, including portable devices, and processed only to the extent strictly necessary to achieve the purposes indicated above by specifically appointed internal or external parties bound by confidentiality. The data are stored in electronic and paper records, with full implementation of the security measures required by law.

 

6. DISCLOSURE AND TRANSFER OF DATA TO NON-EU COUNTRIES

The data may be disclosed:

- to internal personnel of Ditta Artigianale s.r.l. specifically authorized to perform activities connected with and instrumental to managing the requested services;

- to parties specifically appointed as Data Processors.

The data provided are stored at the Data Controller's premises and on servers located within the territory of the European Union and will not be transferred outside that territory.

The Data Controller may also disclose the Data Subject's data referred to in section 2, for the purposes referred to in section 4, to public entities entitled to receive them by law, judicial authorities, and any other parties to whom disclosure is mandatory for institutional purposes.

These parties will process the data in their capacity as independent data controllers.

 

7. DATA RETENTION PERIODS

The data will be retained for no longer than necessary to achieve the purposes for which they are processed, including archiving and protecting the rights of the Data Controller, in full compliance with the storage limitation principle set out in the GDPR, and/or for the period necessary to comply with legal obligations. The obsolescence of the retained data in relation to the purposes for which they were collected is reviewed periodically.

 

8. DATA SUBJECT'S RIGHTS

With regard to their data, the Data Subject has the right to ask the Data Controller, in the manner indicated and in the cases provided for by the GDPR, for:

- access to the data (the Data Subject has the right to obtain confirmation as to whether processing exists, as well as information about the data processed and the right to receive a copy thereof);

- rectification of inaccurate data and completion of incomplete data (the Data Subject has the right to request the updating or correction of their personal data);

- erasure of the data, also known as the “right to be forgotten” (the Data Subject may request the erasure of their personal data in the cases and under the conditions set out in art. 17 of the GDPR);

- restriction of processing in the cases provided for (the Data Subject may request restriction of the processing of their data in the cases set out in art. 18 of the GDPR. If processing is restricted, the personal data will be processed, except for storage, only with the Data Subject's consent or for the establishment, exercise, or defense of a legal claim, or to protect the rights of another natural or legal person, or for reasons of substantial public interest of the Union or of a Member State);

- data portability (in the cases and under the conditions set out in art. 20 of the GDPR, the Data Subject has the right to receive their data in a structured, commonly used, and machine-readable format and, where technically feasible, to obtain its transfer to another Data Controller without hindrance);

- objection to processing (the Data Subject has the right to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them pursuant to Article 6(1)(e) or (f), including profiling based on those provisions. The Data Controller shall no longer process the personal data unless there are compelling legitimate grounds for proceeding with the processing which override the interests, rights, and freedoms of the Data Subject, or for the establishment, exercise, or defense of a legal claim);

- the right to withdraw their consent at any time where processing is based on Article 6(1)(a) or art. 9(2)(a) of the GDPR. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

In any event, the Data Subject always has the right to lodge a complaint with the competent supervisory authority (the Italian Data Protection Authority), pursuant to art. 77 of the GDPR, if they consider that the processing of their personal data violates applicable law.

 

9. HOW TO EXERCISE RIGHTS

To exercise the above rights, the Data Subject must submit their request directly to the Data Controller using the contact details provided in the section “Identity and Contact Details of the Data Controller”.