EN
ItalianoPURPOSE OF THIS NOTICE
Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (hereinafter the “Regulation” or “GDPR”) and Legislative Decree No. 196 of 30 June 2003, as amended by Legislative Decree No. 101 of 10 August 2018 (hereinafter the “Italian Personal Data Protection Code”), this page describes how the personal data of users who visit the website of Michele Caroli Srl, accessible online at the following address: https://www.michelecaroli.com, are processed.
Please note that, as a result of visiting this website, data relating to identified or identifiable persons may be processed.
This notice applies exclusively to the website https://www.michelecaroli.com and does not cover other websites, pages or online services that may be reached through hyperlinks published on the website, which are operated by third parties acting as independent data controllers.
Likewise, this notice does not cover the online sales platform available at https://e-commerce.michelecaroli.com: the related processing operations, although carried out by Michele Caroli Srl as data controller, are described in a dedicated privacy notice available on that subdomain, owing to the different purposes and methods of processing involved (account registration and management, and handling of orders, payments, shipping and after-sales support).
Identity of the Data Controller
The data controller is Michele Caroli Srl, with registered office at S.P. Bari-Modugno Km 0.800, 70026 Modugno (BA), Italy. Email: info@michelecaroli.com, Tel.: +39 080 5379095 (hereinafter also the “Controller”).
DATA PROTECTION OFFICER (DPO)
Pursuant to Article 37 of Regulation (EU) 2016/679, the Company has appointed Roberto Froio as its Data Protection Officer (DPO).
Data subjects may contact the Data Protection Officer directly on any matter relating to the processing of their personal data and to the exercise of their rights under Regulation (EU) 2016/679.
DPO email address: info@robertofroio.net
The DPO carries out their functions in accordance with Articles 38 and 39 of Regulation (EU) 2016/679.
Data sources and types of data collected
1) Data provided by the User
The Controller collects the personal data provided by users:
a) when subscribing to the newsletter service offered on the Website. The data collected by the Controller may include, by way of example but not limited to: personal details (first and last name) and contact details (email address).
b) when sending a message using the addresses and/or contact forms available on the website. The optional and voluntary sending of messages to the contact addresses, as well as the completion and submission of the forms on the website, entail the collection of the sender’s contact details needed to reply, as well as of any personal data included in the communications.
The data provided will be processed using IT and electronic tools for the sole purpose of providing the requested service.
2) Browsing data
The Controller collects data relating to the User’s use of the Website. This information is acquired by the computer systems and software procedures used to operate the website during their normal operation; moreover, its transmission is inherent in the use of Internet communication protocols.
This category includes the IP addresses or domain names of the computers and devices used by users, the URI/URL (Uniform Resource Identifier/Locator) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the server’s response, and other parameters relating to the user’s operating system and IT environment.
These data, which are necessary to use the web services, are also processed in order to:
– obtain statistical information on the use of the services (most visited pages, number of visitors by hour or day, geographical areas of origin, etc.);
– check the correct functioning of the services offered and ensure the security of the website.
Browsing data are not kept for more than seven days and are deleted immediately after being aggregated (except where needed by the judicial authorities to investigate criminal offences).
3) Cookies and other tracking tools
In order to make its services as efficient and easy to use as possible, this Website uses cookies.
Therefore, when you visit the Website, a minimal amount of information is placed on the User’s device, such as small text files called “cookies”, which are saved in the User’s web browser directory. There are different types of cookies, but essentially the main purpose of a cookie is to make the Website work more effectively and to enable certain features.
Cookies and other tracking tools are used in compliance with Article 122 of Legislative Decree 196/2003 and with the “Guidelines on cookies and other tracking tools” adopted by the Italian Data Protection Authority (Garante per la protezione dei dati personali) by decision No. 231 of 10 June 2021: technical cookies do not require the User’s consent, whereas profiling cookies and other non-technical tracking tools are used only with the User’s prior consent, which may be freely withdrawn at any time.
For more information on the cookies used by this website, please see the cookie policy below.
Purposes of processing
Depending on the type of processing to be carried out, the Controller uses the data collected and/or provided by the User for the following purposes:
1) sending newsletters for information or commercial promotion purposes (e.g. invitations to events, communications about new services, promotional offers). Such processing may be carried out by automated means via email, provided that the data subject has not withdrawn their consent to the use of their data;
2) responding to any communications, requests for information and/or services sent by users through the addresses and/or contact forms available on the website;
3) managing and monitoring risks, preventing possible fraud, insolvency or defaults; preventing and managing possible disputes, and taking legal action where necessary;
4) ensuring the proper functioning, maintenance and security of the Website and its infrastructure, and obtaining aggregate statistical information on the use of the services.
Legal basis for processing
With reference to the purposes set out in the previous section, the legal basis is, respectively:
1) the consent given by the data subject (Article 6(1)(a) of the Regulation and Article 130 of Legislative Decree 196/2003);
2) the need to perform a contract to which the data subject is party or to take steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) of the Regulation);
3) the pursuit of the Controller’s legitimate interest, in particular the prevention of fraud and insolvency and the protection of its rights in legal proceedings (Article 6(1)(f) of the Regulation);
4) the pursuit of the Controller’s legitimate interest in the security and proper functioning of the Website (Article 6(1)(f) of the Regulation).
Recipients of the data
The personal data processed by the Controller are not disseminated, i.e. they are not disclosed to unspecified parties in any form, including by making them available or allowing them to be consulted.
They may, however, be disclosed to employees of the Controller, or to persons authorised to process the data under the authority of the Controller pursuant to Article 29 of the Regulation. On the basis of their roles and duties, these persons have been authorised to process personal data, within the scope of their respective competences and in accordance with the instructions given to them by the Controller.
The Controller has engaged third-party service providers in connection with the operation of the Website, such as hosting providers, website service providers, IT maintenance providers, and providers of services that allow other features, which users may use at their discretion, to be integrated into the Website.
These service providers, appointed as Data Processors pursuant to Article 28 of the Regulation, receive only the personal data necessary to provide their respective services and are not permitted to use or disclose data subjects’ personal data for other purposes without the data subject’s prior authorisation.
Data may also be disclosed, to the extent strictly necessary, to parties who must supply goods and/or perform services on behalf of the Controller for the purpose of fulfilling orders or other requests, or of providing services relating to the transaction or contractual relationship with the Controller.
Finally, data may be disclosed to parties entitled to access them by virtue of laws, regulations or EU legislation.
Data transfers
Personal data are normally processed on servers located within the European Economic Area (EEA).
The Controller reserves the right to use cloud services or other IT services that involve the transfer of personal data to third countries. In such case, the transfer will take place only where one of the conditions set out in Chapter V of the Regulation is met, and in particular:
– to countries for which the European Commission has adopted an adequacy decision pursuant to Article 45 of the Regulation (including, for certified US organisations, the EU-U.S. Data Privacy Framework);
– where appropriate safeguards are in place pursuant to Article 46 of the Regulation, such as the Standard Contractual Clauses adopted by the European Commission, supplemented, where necessary, by additional measures following a transfer impact assessment;
– or on the basis of the derogations provided for in Article 49 of the Regulation.
In any case, service providers will be selected among those offering adequate guarantees. Users may request a copy of the safeguards adopted by writing to the contact details provided in this notice.
Data retention
The Controller retains and processes personal data for as long as necessary to fulfil the purposes stated. Thereafter, personal data will be stored, without being further processed, for the period required by applicable civil and tax law.
Data provided for commercial promotion purposes relating to services other than those already purchased by the data subject, for which the data subject initially gave consent, will be kept for 24 months, unless consent is withdrawn.
Where the user spontaneously provides personal data that are not necessary for the purpose of the communication, the Controller will limit their processing to what is strictly necessary to handle the request and, where there are no adequate grounds for further retention, will delete them in accordance with the principles of data minimisation and storage limitation laid down in Regulation (EU) 2016/679.
Rights of the data subject
With regard to the data processed under this notice, the data subject has the right, at any time, to:
– request from the Controller access to their personal data and to information relating to it (Article 15 GDPR); rectification of inaccurate data or completion of incomplete data (Article 16 GDPR); erasure of personal data concerning them (where one of the conditions set out in Article 17(1) GDPR applies, and subject to the exceptions in paragraph 3 of the same Article); restriction of the processing of their personal data (where one of the cases set out in Article 18(1) GDPR applies);
– request and obtain from the Controller – where the processing is based on a contract or consent and is carried out by automated means – their personal data in a structured, commonly used and machine-readable format, including for the purpose of transmitting such data to another controller (right to data portability – Article 20 GDPR);
– object at any time to the processing of their personal data on grounds relating to their particular situation (Article 21(1) GDPR), and object at any time, without giving reasons, to the processing of their personal data for direct marketing purposes (Article 21(2) GDPR);
– withdraw consent at any time, where the processing is based on consent for one or more specific purposes. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal (Article 7(3) GDPR).
Requests may be submitted to the Controller by certified email (PEC) to info@pec.michelecaroli.com, by email to info@michelecaroli.com, or by registered letter with return receipt to S.P. Bari-Modugno Km 0.800, 70026 Modugno (BA), Italy, or by contacting the Data Protection Officer at the details provided above.
If the data subject believes that the processing of their data infringes the Regulation, they may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, Italy – www.garanteprivacy.it), or with the supervisory authority of the EU Member State in which they habitually reside or work or in which the alleged infringement took place, pursuant to Article 77 GDPR and Articles 140-bis et seq. of Legislative Decree 196/2003, or take legal action before the competent courts (Articles 78 and 79 GDPR).
Refusal to provide data
Where the data subject does not provide the data identified as necessary for the performance of the requested service, the Controller will be unable to carry out the processing related to the management of that service or the obligations depending on it.
Where the data subject does not give consent to the processing of personal data for activities that require it, such processing will not take place for those purposes, without any effect on the provision of other requested services or on those for which consent has already been given. Where the data subject has given consent and subsequently withdraws it or objects to the processing, their data will no longer be processed for those activities, without any adverse consequences for the data subject or for any other requested services.
Automated decision-making
The Controller does not carry out processing consisting of automated decision-making, including profiling, as referred to in Article 22(1) and (4) of the Regulation.