1. Porposes, legal grounds for personal data processing
Processing the personal data provided by you is solely aimed at performing contractual obligations and fulfilling specific requests, as well as meeting regulatory obligations, in particular accounting and tax ones.
Under legal grounds of processing, the source/origin/justification thereof in a legal provision as well as in the fulfilment of a contract or a request by the data subject is meant. 2. Source from which personal data originates
The personal data processed is provided by the data subject via:
- interactions through a website;
- requests for information, including e-mail and telephone ones
- previous transactions. 3. Processing methods
In relation to the specified purposes, your data is processed electronically and on paper records. Processing is carried out in such a way as to ensure the logical, physical safety and confidentiality of your personal data.
4. Nature of personal data
The data being processed is your personal data with regard to the performance of the service you have requested.
Consent to the conferment of your personal data is mandatory in order to execute the contract in place, or perform the services requested and fulfil the obligations resulting therefrom, including legal obligations. 5. Scope of data communication and dissemination
Your data may be communicated to:
• all subjects to whom access to such data is recognised by virtue of regulatory provisions;
• our collaborators as well as employees, within the scope of their tasks and duties;
• all those natural and/or legal, public and/or private persons when communication is necessary or effective for the performance of our business, in the manner and for the purposes described above; 6. Metods and personal data lifespan.
The Data Controller, data supervisor and persons authorised to/in charge of processing will handle the personal data for the time necessary to fulfil the aforementioned purposes and, in any case, for no longer than 10 years from the relationship termination, where provided for or required by the regulations in force, subject to longer limitation periods. 7. Rights of data subjects
7.1 Art. 15 (right of access) , 16 (right to rectification) of EU Reg. 2016/679
The data subject is entitled to obtain from the data controller confirmation that its personal data is being processed and, if so, to obtain access to its personal data and the following information:
a) processing purposes
b) categories of the personal data in question;
c) recipients or categories of recipients to whom the personal data has been or will be communicated, in particular if recipients are from third countries or international organisations;
d) the personal data expected lifespan or, if not possible, the criteria used to determine this period;
e) the existence of the data subject’s right to request the data controller to rectify or erase the personal data, or limit or oppose the processing of the personal data;
f) the right to lodge a complaint with a supervisory authority;
h) the existence of an automated decision-making process, including profiling and, at least in these cases, significant information on the logic used, as well as the importance and expected consequences of such processing for the data subject.
7.2 Right pursuant to art. 17 of EU Reg. UE 2016/679 - right to erasure («right to oblivion»)
The data subject is entitled to obtain the erasure of its personal data from the data controller without undue delay, and the data controller is obliged to erase the personal data without undue delay if one of the following reasons exists:
a) the personal data is no longer necessary with respect to the purposes for which it was collected or otherwise processed;
b) the data subject revokes the consent on which processing is based in accordance with Article 6 (1) (a) or Article 9 (2) (a), and if there are no other legal grounds for processing;
c) the data subject opposes processing pursuant to Article 21 (1), and there is no prevailing legitimate reason to proceed with processing, or opposes processing pursuant to Article 21 (2);
d) the personal data has been processed unlawfully;
e) the personal data must be erased to fulfil a legal obligation under the law of the European Union or of the Member State the controller is subject to;
f) the personal data has been collected in relation to the offer of information society services referred to in Article 8, paragraph 1 of Reg. EU 2016/679 7.3 Right pursuant to art. 18 Right to restriction of processing
The data subject is entitled to obtain restriction of processing from the controller where one of the following applies:
a) the accuracy of the personal data is disputed by the data subject for a period enabling the controller to check the personal data for accuracy;
b) processing is unlawful and the data subject opposes the erasure of the personal data and requests, however, to restrict the use thereof;
c) although the controller no longer needs the personal data for processing purposes, this data is required by the data subject for the establishment, exercise or defence of legal claims;
d) the data subject has objected to processing pursuant to Article 21 (1) Reg EU 2016/679 pending verification whether the controller’s legitimate grounds are prevailing over the data subject’s ones.
7.4 Right pursuant to Art. 20 Right to data portability
The data subject is entitled to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format, and to transmit this data to another controller without being hindered by the data controller. 8. Revocation of processing The data subject is entitled to revoke consent to processing its personal data by contacting the Data Controller.
Personal data controller: Arval srl Vat No. 00792900151
Address: Viale Bligny 30 – 20136 Milano
Telephone/fax : +390258321002 / +390258321264
e-mail : info@arvalcosmetici.com
|