In view of this purpose, data processing will include the management, organisation and use of data, administrative activities following successful purchases and invoice delivery, data storage, creation of a database, soft spam and marketing activities pursuant to Article 130, Paragraph 4 of the Privacy Code, which users can oppose at any time via the “unsubscribe” function at the bottom of emails, as well as the execution of statistics, communication to partners with whom the service has been developed, as well as the individuals appointed for data processing pursuant to Article 28 of the GDPR, communication to the courier in order to ship the purchased product, communication to members of the Data Controller’s organisation, and finally, communication to business management consultants. Furthermore, data processing will also include the destruction and modification of processed data following notification by the interested party and his or her consultation. Data processing will be carried out throughout the EU and outside the EU in the cases falling within the relevance of Articles 45 and 46 of the GDPR.
In relation to the transfer of data to non-EU territories, the Data Controller informs users that the data they provide may also be transferred to countries outside the EU in accordance with the provisions set forth in Chapter V of the EU Regulation.
Data processing may be carried out both in paper and electronic form by subjects specifically authorised to process it. The Data Controller does not process data based on decision-making processes on a solely automated basis, nor does it perform profiling.
The provision of data is optional, however, in the event of failure to provide the necessary data, or its partial or untruthful provision, the request to purchase the Data Controller’s products may not be accepted or correctly processed. The sending of the completed purchase form will authorise the Data Controller to process data, based on the legal basis pursuant to Article 6, Paragraph 1, Letter B (processing necessary for the execution of the contract).
Data will be stored for 10 years for administrative purposes, as well as for the length of time necessary to meet the purposes of its collection.
The Data Controller also informs users that the rights expressed in Article 13, Paragraph 2 of the GDPR are guaranteed, and therefore:
– The right to access personal data and related information listed under Article 15 of the GDPR;
– The right to the correction or cancellation of data or the limitation of data processing;
– The right to oppose data processing;
– The right to data transfer;
– The right to revoke consent at any time without jeopardising the lawfulness of data processing based on the consent given before revocation, if data processing is based on Article 6, Paragraph 1, Letter A, or on Article 9, Paragraph 2, Letter A;
– The right to make a complaint to a supervisory authority. Users can exercise the rights listed above, or request more information about them by sending an email to the following email address: firstname.lastname@example.org, indicating “Exercising rights ex GDPR” in the subject line and including the right to be exercised in the body of the email, as well as the user’s name, surname and reply email address. Once processed as received, the Data Controller will send confirmation within the terms indicated in Article 12, Point 3 of the GDPR.
The Data Controller also informs users that the rights listed and guaranteed by Articles 15 to 22 of the GDPR cannot be exercised with a request to the Data Controller or via a complaint pursuant to Article 77 of the GDPR if said exercise could result in actual or concrete prejudice in relation to certain categories of interested parties and/or specific activities as listed in Article 2-undecies pursuant to Legislative Decree No. 196/03 as amended by Legislative Decree No. 101/2018. This point remains valid except as specified by the legislator in Paragraph 2 and 3 of the aforementioned article.
The Data Controller also advises users that if the company intends to process personal data for a purpose other than that for which it was initially collected, it will provide the interested party with information regarding the different purposes prior to said further processing, as well as any other relevant information, collecting specific consent.