Privacy Policy

DATA CONTROLLER

MODALYSSA STORE DI R.A. with registered office in Via di mezzo 9 25079 Vobarno (Brescia) , ItalyPhone: 3802670452 Email: [email protected] VAT / CF: 03969180987

TYPES OF DATA PROCESSED

The processing activities carried out are aimed at acquiring the following personal data:

·        Behavioral data: Navigation log, Authentication log.

·        Common data: Personal data.

·        Economic data: Income, Tax, Banking.

PURPOSE OF THE PROCESSING AND CONDITION THAT MAKES THE PROCESSING LAWFUL

1. CUSTOMERS - Execution of the Contract
The processing of personal data is necessary for the acquisition of information necessary for the conclusion and execution of the contract stipulated with the Data Controller.

Condition Lawfulness Of Processing: Execution of the Contract - Art. 6, c.1, let. b. GDPR

Purpose of the processing:

·        Execution and management of the contract stipulated with the Data Controller.

·        Acquisition of preliminary information at the conclusion of contracts.

·        Communications transmitted and / or received to / from customers related to the execution and / or stipulation of the contract, performed through different means of communication such as telephone, email (e-mail), instant messaging, paper mail.

Nature of the provision: Mandatory - Failure to provide data will make it impossible for the Data Controller to execute the contract.

Personal data retention period: Personal data, used for the execution of the contract, will be processed for the time necessary to manage the existing relationship with the Data Controller. The information collected for the evaluation of the conclusion of the contract, in case of non-completion, will be deleted within 6 months.

Processing Methods: The processing is carried out, mainly, with IT tools.

2. CUSTOMERS - Legal obligations
The processing of personal data is necessary for the fulfillment of obligations under laws, regulations and / or community regulations, supervisory / control bodies or other authorities legitimated to do so.

Condition Lawfulness Treatment: Legal Obligation - Art. 6, c.1, let. c. GDPR

Purpose of the processing:

·        Storage of accounting and administrative documents in paper form.

·        Preservation of accounting and administrative documents in digital form.

·        Digital preservation of invoices issued/received (electronic invoicing).

Nature of the provision: Mandatory - Failure to provide data will make it impossible for the Data Controller to execute the contract.

Personal data retention period: Personal data will be processed for this purpose for the time necessary for the fulfillment of legal obligations under current legislation. In this regard, personal data will be kept for 10 years starting from the termination of the contract or, if later, from a binding decision issued by a competent authority, without prejudice to any retention obligations relating to particular categories of data, for longer periods of time, prescribed by the legal system.

Processing Methods: The processing is carried out, mainly, with IT tools.

3. CUSTOMERS - Profiling
Analysis of data that reveal habits and behaviors of the interested party useful for the creation of profiles that can also be used for commercial initiatives.

Condition Lawfulness Of Processing: Consent - Art. 6, c.1, let. a. GDPR

Purpose of the processing:

·        Analysis of data that reveal habits and behaviors to propose products / services better corresponding to the requests / needs of the interested party.

Nature of the provision: Optional - Failure to provide data will make it impossible for the interested party to receive products / services better corresponding to the needs of the same.

Personal data retention period: Profiling processing will be carried out on personal data recorded in the last 12 months. The profiled datasets will be used/retained for 6 months from the generation of these. The deletion of the profiled data set will take place - after 6 months from generation; - or, immediately, following the revocation of the consent formulated by the interested party - or, immediately, following the interruption of the contract with the interested party.

Processing Methods: The processing is carried out, mainly, with IT tools.

4. CUSTOMERS - Marketing
Transmission of commercial proposals promoted by the Data Controller.

Condition Lawfulness Of Processing: Consent - Art. 6, c.1, let. a. GDPR

Purpose of the processing:

·        Transmission of commercial newsletters to the e-mail addresses of customers and / or potential customers.

·        Transmission of instant messages through tools such as SMS, Whatsapp, Telegram.

·        Transmission of messages by paper and electronic means (email).

Nature of the provision: Optional - Failure to provide data will make it impossible for the interested party to receive messages relating to the promotions proposed by the Data Controller

Personal data retention period: The deleted data will be deleted immediately following the termination of the contract or withdrawal of consent. The data relating to the prospects, for which the contract will not be finalized, will be deleted within 24 months of registration.

Processing Methods: The processing is carried out, mainly, with IT tools.

5. SITE - Navigation Data
Obtain anonymous statistical information on use, check the correct functioning of the site, ascertain responsibility in case of hypothetical computer crimes against the Data Controller.

Condition Lawfulness Of Processing: Legitimate Interest - Art. 6, c.1, let. f. GDPR

Purpose of the processing:

·        Data analysis to perform the evolution and maintenance of the website.

·        Ascertainment of responsibility in case of potential computer crimes against the site and / or the Data Subjects.

·        Statistical analysis, anonymous, on the use of the site.

Nature of the provision: Mandatory - Failure to provide data will make it impossible for the company to provide the web service provided.

Personal data retention period: The data is kept for 30 days.

Processing Methods: The processing is carried out with IT tools.

6. CUSTOMERS - Marketing for similar products
Transmission of newsletters concerning similar products already purchased by customers.

Condition Lawfulness Treatment: Soft Spam - Art. 130 paragraph 4

Purpose of the processing:

·        Transmission of commercial proposals relating to similar products already purchased / requested by customers.

Nature of the provision: Optional - Failure to provide data will make it impossible for the interested party to receive newsletters relating to promotions proposed by the Data Controller

Personal data retention period: The deleted data will be deleted immediately following the termination of the contract or opposition to the processing.

Processing Methods: The processing is carried out, mainly, with IT tools.

7. SITE - Requests from the Site
Requests made by the interested parties through the website of the Data Controller.

Condition Lawfulness Of Processing: Execution of the Contract - Art. 6, c.1, let. b. GDPR

Purpose of the processing:

·        Sending requests through web platform tools.

Nature of the provision: Optional - Failure to provide data will make it impossible for the Data Controller to respond to the requests of the interested party.

Personal data retention period: Processing of the request.

Processing Methods: The processing is carried out with IT tools.

8. SITE - Use of the Service and Reserved Area
Use of the services offered through the reserved area of the Owner's website.

Condition Lawfulness Of Processing: Execution of the Contract - Art. 6, c.1, let. b. GDPR

Purpose of the processing:

·        Registration within the reserved area.

·        Use of the service provided through access to the reserved area of the site.

Nature of the provision: Optional - Failure to provide data will make it impossible for the Data Controller to provide services through the reserved area of the site.

Personal data retention period: Deletion of the user.

Processing Methods: The processing is carried out with IT tools.

9. FACEBOOK SOCIAL PAGE

When a user uses the Page administered by the Owner, Facebook ("Social Media") collects information such as the types of content viewed or interacted with, the actions performed as well as information on the devices used (IP addresses, operating system, browser type, language settings, cookie data).

Page Insights  are aggregated statistics created by certain events recorded by Facebook's servers when users interact with Pages and the content on them.

As   illustrated in facebook's Privacy Policy, Social Media also collects and uses information to provide statistical data collection services called  Page Insights  to page administrators to allow them to understand how people interact with the content on them.

Details on the processing methods performed by Facebook are available at the following link:

https://www.facebook.com/privacy/explanation

Details on the personal data processed for Insights are available at the following link:

https://www.facebook.com/legal/terms/information_about_page_insights_data

Details on the cookies used by Facebook are available at the following link:

https://www.facebook.com/policies/cookies/

The Data Controller as the administrator of the Page and Facebook Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) are joint controllers in accordance with Article 26 of the GDPR for the processing of such personal data recorded for events provided through  Page Insights ("Insights Data").

The joint ownership agreement, between the Data Controller and Facebook, covers the creation of such events and their aggregation in Insights on the Page provided to each administrator.  

The legal basis of the processing is the legitimate interest of the Data Controller, Article 6, paragraph 1, letter f), GDPR. Therefore, it is not necessary to acquire your prior consent to the processing.

Condition Lawfulness Of Processing: Legitimate Interest - Art. 6, c.1, let. f. GDPR

Purpose of the processing:

·        Statistical surveys relating to the use of elements contained within the Facebook page administered by the Data Controller.

Nature of the provision: Mandatory - Failure to provide the requested data will make it impossible for the Data Controller to provide services through the Page published on Facebook.

Personal data retention period: The data collected will be processed for the time strictly for the realization of the purposes described above as specified in the Facebook policies described above.

Processing Methods: The processing is carried out by computer means by the Facebook Joint Controller

EXTRA-EU DATA TRANSFER

Personal data are processed exclusively within the European Union.

RECIPIENTS OF THE TREATMENT

·        Data Processor: Administrative and Tax Consulting; Services maintenance of ICT systems; Website Hosting Services; Services for Privacy and personal data protection; Payment circuits.

·        Autonomous Owner: Banking Institutions.

RIGHTS OF THE INTERESTED PARTY - COMPLAINT TO THE SUPERVISORY AUTHORITY

In relation to the processing described in this Notice, as an interested party you may, under the conditions provided for by the GDPR, exercise the rights enshrined in articles 15 to 22 of the GDPR and, in particular, the following rights:

·        right of access – article 15 GDPR: right to obtain confirmation as to whether or not personal data concerning you are being processed and, in this case, to obtain access to your personal data;

·        right of rectification – article 16 GDPR: right to obtain, without undue delay, the correction of inaccurate personal data concerning you and / or the integration of incomplete personal data;

·        right to erasure (right to be forgotten) – Article 17 GDPR: right to obtain, without undue delay, the erasure of personal data concerning you. The right to erasure does not apply to the extent that the processing is necessary for the fulfilment of a legal obligation or for the performance of a task carried out in the public interest or for the establishment, exercise or defence of a right in court.

·        right to restriction of processing – Article 18 GDPR: right to obtain the limitation of processing, when: a) the interested party disputes the accuracy of personal data; b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests instead that their use be restricted; c) the personal data are necessary for the interested party to ascertain, exercise or defend a right in court; d) the interested party has opposed the processing pending verification of the possible prevalence of the legitimate reasons of the data controller with respect to those of the interested party.

·        right to data portability – article 20 GDPR: right to receive, in a structured format, commonly used and readable by an automatic device, the personal data concerning you provided to the Data Controller and the right to transmit them to another owner without impediments, if the processing is based on consent and is carried out by automated means. In addition, the right to obtain that your personal data are transmitted directly from this holder to another holder if this is technically feasible;

·        right to object – article 21 GDPR: right to object, at any time, to the processing of personal data concerning you based on the condition of legitimacy of the legitimate interest, including profiling, unless there are legitimate reasons for the Data Controller to continue the processing that prevail over the interests, rights and freedoms of the interested party or for the assessment,  the exercise or defence of a right in court.

·        right not to be subjected to automated decision-making – Article 22 GDPR: the data subject has the right not to be subjected to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or which similarly significantly affects his person, unless this is necessary for the conclusion or execution of a contract or you have given your consent. In any case, an automated decision-making process cannot concern your personal data and you can at any time obtain human intervention from the data controller, express your opinion and contest the decision.

·        right to lodge a complaint with the Guarantor Authority for the protection of personal data: http://www.garanteprivacy.it;

·        revoke the consent given on every occasion and with the same ease with which it was provided without prejudice to the lawfulness of the processing based on the consent given before the revocation.

The above rights may be exercised against the Data Controller by contacting the references indicated above. The exercise of your rights as a data subject is free of charge pursuant to Article 12 GDPR. However, in the case of manifestly unfounded or excessive requests, also due to their repetitiveness, the Data Controller may charge you a reasonable expense contribution, in light of the administrative costs incurred to manage your request, or deny the satisfaction of your request. Finally, we inform you that the Data Controller may request further information necessary to confirm the identity of the interested party.