Pursuant to and for the purposes of Articles 13 and 14 (where data are not obtained from the data subject) of Regulation EU 2016/679 in force since 25/05/2018 as well as in compliance with Law Decree 101/2018 in force since 19/09/2018, we inform the subjects (hereinafter referred to as Data Subjects) who shall subscribe to the newsletter service regarding the processing of personal data.
1. CONTACTS
The Data Controller is ECSEN s.r.l. unipersonale with registered office in via dell'Artigiano, 23 in Mazzano (BS) Italy. VAT number and fiscal code 02528800986, Economic Administrative Repertoire no. BS 457406. The Data Subject, in order to exercise his own rights, or simply for any information on the processing of personal data, may contact the Data Controller by e-mail at info@giftandlab.com or by certified e-mail at ecsen@pec.it, as well as by registered mail at the address of the operational headquarters.
2. DATA PROCESSED
In order to carry out the Newsletter service we store:
- the e-mail address;
- some personal data such as Name, Surname, Gender, Date of Birth, Language, Company;
To create contents of real interest we could also store:
- latest interactions with the Data Controller (site visit, contact request, offers / orders);
- information about products or services purchased;
- participation in events organized by the Data Controller or in which the latter has participated.
When we send you emails or communications we use tracking systems, such as pixels or web beacons, in order to detect and store:
- the opening of a message;
- the number of clicks on the hyperlinks contained within the e-mail;
- the IP address;
- the type of browser used to open the e-mail.
3. PURPOSE OF PROCESSING
The data collected shall be processed (also electronically) exclusively for the purpose of sending the newsletter for marketing activities (forwarding information, promotional and advertising material) and for supplying (even via email) the information relating to the initiatives of the Data Controller.
4. LEGAL BASIS
The processing of data for the purposes referred to in point 3) has its legal basis in article 6 paragraph 1 letter a) (consent) of Regulation EU 2016/679.
5. PROCESSING METHODS
Personal data shall be processed automatically and entered into the relevant databases, accessible only by the persons in charge of the processing. All data processing operations are carried out in such a way as to guarantee the integrity, confidentiality and availability of personal data.
6. DATA RETENTION PERIOD
The data provided, whether for institutional or for marketing purposes – subject to explicit consent, shall be retained for a period not exceeding the purposes for which they were collected and subsequently processed. As for the retention time of the data collected through the use of profiling tools (eg cookies), see the Cookie Information Notice.
7. DATA RECIPIENTS
In relation to the purposes provided under point 2), besides the data controller, in some cases, a few categories of persons in charge of the organization of the site (administrative, sales, marketing personnel, lawyers, system administrators) as well as external subjects (by way of example including but not limited to: third party technical service providers, mail carriers, hosting providers, IT companies, communication agencies) could have access to the data.
8. PROFILING AND DISSEMINATION
The data may be profiled electronically and through automated procedures for the purposes of internal and organizational statistical analysis.
The data shall not be disseminated in any way.
9. DATA TRANSFER TO NON-EU COUNTRIES
This site may share some of the data collected with services located outside the European Union area. The transfer is authorized according to specific resolutions of the European Union and the Data Protection Authority (see http://www.garanteprivacy.it/home/provvedimenti-normativa/normativa/normativa-comunitaria-e-intenazionale/trasferimento-dei-dati-verso-paesi-terzi – italian language only), therefore no further consent is required.
10. RIGHTS OF THE DATA SUBJECT
The Data Subject, besides the right to lodge a complaint with the Supervisory Authority, holds the rights listed below, as set forth in the articles from 15 to 22 of Regulation EU 2016/679 and which can be enforced by forwarding a request to the Data Controller at the contacts referred to in point 1):
- to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the information on the relevant processing;
- to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement;
- to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies;
- the right to obtain from the controller restriction of processing where one of the following applies:
- the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
- the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
- the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
- the data subject has objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject;
- to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided; in exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible;
- the data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions;
- not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.
Latest revision - information notice version 26/10/2018