Privacy information for users and customers

Data controller and contact details

Normative requirements

Cookies

Interested in the processing and recipients of the Information

Categories of personal data processed, purposes and related legal basis

Revocation of consent and retention period of personal data

Authorized and other recipients of personal data

Transfer of data abroad (outside the EU and EEA)

Rights of interested parties

Right of opposition

Complaint

Updates and revisions to the information

Data controller and contact details

The data controller of the data of navigators, users and customers of the website www.desoleabbigliamento.it (“Site”) is the company Steve Srl (“Company”). The contact details of the Company are as follows:

Viale Italia, 16

07100 - Sassari

E-mail:

privacy@desoleabbigliamento.it

info@desoleabbigliamento.it

telephone: +39 079/2019202 - +39 079/2019208

The same data are published and available for consultation in the "Contacts" section of the Site. Through the Site, through the relevant eCommerce platform, the Company carries out its commercial sales and distribution activity in the clothing sector, providing its users and customers with the relevant services (“Services”).

Normative requirements

The Information is provided by the Company pursuant to article 13 of Regulation (EU) 679/2016 (“GDPR”) on the protection of personal data and in compliance with Legislative Decree 196/2003, as amended by Legislative Decree 101/2018, as well as the provisions of the Guarantor Authority for the protection of personal data ("Guarantor").

Cookies

For the processing of navigation data carried out using cookies, please refer to the relevant Cookie Policy published on the Site.

Interested in the processing and recipients of the Information

Subjects interested in whom it is destined the Information (“Data Subjects”) are the simple ones navigators , the users of the Site ei clients of the Company who, respectively:

1. use the Site in any capacity (for example, to request information regarding the Services or simply to browse and view products, offers, etc.);
2. register on the Site using the appropriate form form online, in order to access your reserved area and use the Services;
3. they make purchases on the Site, after registering and receiving information relating to the orders placed.

As part of these relationships, the Company processes the personal data of the interested parties for the purposes and in the manner described below.

Categories of personal data processed, purposes and related legal basis

The following are listed categories of personal data of users of the Site and customers treated by the Company as part of the Services and their respective relationships, in compliance with:

1. minimization principle of the data (article 5.1.c. of the GDPR),
2. principle of purpose limitation , with indication of the relative specific processing purpose (article 5.1.b. of the GDPR) e
3. principle of lawfulness, with indication of the relative legal basis for each purpose (article 5.1.a. of the GDPR).

For the purposes of providing the Services, the Company does not need to process particular categories of personal data , as defined in Article 9 of the GDPR (data on racial and ethnic origin, religious or philosophical beliefs, trade union or political membership, data relating to health, biometric, genetic or orientation sexual), therefore, users and customers are asked not to send these categories of data , without prejudice to the fact that if received, the Company will immediately delete them.

Personal data processed:

Specific purpose of the processing:

Legal basis:

common and contact data of users who register on the Site: name and surname, company name/name, email, telephone, gender and date of birth

these data are processed for the purpose of:

1. allow users to register on the Site to access your reserved area and use the Services;
2. respond to requests for information of users forwarded through the Site;
3. send newsletters and promotional and information material on the Services and products sold by the Company to emails provided by users;
4. to carry out a statistical analysis of the categories of users who register on the Site based on gender and age.

for the purposes ( i) And (ii) the legal basis of the processing is, respectively,

• the execution of pre-contractual measures And the fulfillment of contractual obligations towards registered users (article 6.1.b. GDPR);

for the purposes (iii) And (iv) the legal basis of the processing is

• The consent of the user to the sending of newsletters (article 6.1.a. GDPR) expressed by means of a specific tick before registration and to the provision of gender and date of birth by completing the form form of registration

common and contact data (which: name, surname, company name/name, email, telephone, shipping address, billing information, products purchased) related to purchasing, shipping, payment and customer wish lists of the Company who purchase the products through the eCommerce platform and use the related Services

These data are processed by the Company exclusively for the purpose of:

1. manage the contractual sales relationship established with the customer (from order confirmation to possible management of returns, in case of withdrawal, and to the activity of customer care after-sales);
2. ship the products purchased at the addresses indicated by customers;
3. contact customers again who, through the wish list, have requested the Company to be informed about certain products or Services (for example, regarding the size of a certain item of clothing);
4. issue receipts/invoices confirming payment and manage the related activities connected to obligations to keep accounting and tax records ;
5. send newsletters, promotional and information material and discounts relating to the sale of products and the provision of Services offered by the Company only to customers who have purchased products or Services through the Site and the eCommerce platform (so-called soft spam ). The customer may object at any time to the sending of the aforementioned communications by simply notifying the Company ( opt-out exercise).

for the purposes (i) , (ii) And (iii) the legal basis of the processing is

• the execution of pre-contractual measures requested by customers And the fulfillment of contractual obligations towards them (article 6.1.b. GDPR);

for the purpose (iv) the legal basis of the processing is:

• the fulfillment of legal obligations (article 6.1.c. GDPR);

for the purpose (v) the legal basis of the processing is

• legitimate interest of the Company, on the one hand, to evaluate and improve the quality of the Services offered and customer preferences; on the other, carry out direct marketing campaigns aimed at building customer loyalty with promotional offers in line with the products and Services already purchased and the preferences expressed through the wish list (article 6.1.f. GDPR).

Revocation of consent and retention period of personal data

The processing of data for which consent is required lasts until the consent is revoked , the revocation or refusal to give consent involves the immediate interruption or impossibility of sending newsletters and information material and, in the case of statistical analysis, extrapolation from the established lists.

The data retention time processed on legal bases other than consent is determined by the type of relationship established:

1. with the navigator , please refer to the Cookie Policy for the possible storage of cookies sent by the Site and installed on the navigator's devices;
2. with them users who register on the Site , as a result of the contractual relationship established with the Company, the related personal data are processed for the entire duration of the relationship, until the user requests the deactivation of their reserved area and the deletion of the related data personal, except those that must be kept on the basis of legal obligations;
3. with i customers who purchase the products and Services through the eCommerce platform and the Site, as a result of the contractual relationship established with the Company, the personal data relating to purchases made (including any returns and refunds) are processed by the Company for the entire duration of the contractual relationship and subsequently deleted from the databases of the Company, taking into account the technical and administrative times necessary for the deactivation of the reserved area and selection of data whose conservation is mandatory by law;
4. the data relating to invoicing and keeping of accounting records must be kept by the Company for ten years pursuant to article 2220 of the Civil Code;

In any case, the Company, in accordance with the principle of storage limitation referred to in article 5.1.e. GDPR, carries out a periodic check, every 5 years starting from January 2020, to determine whether there is data of users and customers with whom there have been no relationships of any kind for more than 5 years from the last contact, for which it is foreseen cancellation.

The possible establishment of a proceeding before the judicial authorities or any negotiations/agreements of an extrajudicial nature in progress between the Company and the interested parties, entail the extension of the aforementioned data retention terms and criteria

Authorized and other recipients of personal data

The personal data of navigators, users and customers are processed by the Company's staff in accordance with the authorizations and instructions specifically provided to each employee/collaborator, who are in any case bound by confidentiality obligations on personal data and the processing limits deriving from the specific task or assignment performed under the authority of the Company.

In addition to the aforementioned subjects, the personal data of navigators, users and customers may be communicated by the Company, within the limits of achieving the purposes for which they are processed and the related legal bases, to the following categories of subjects external to the Company:

1. company that provides tailoring services to customers;
2. IT infrastructure development, management, support and maintenance providers;
3. suppliers of software management, applications and hardware and related assistance/maintenance and management;
4. providers of connectivity and email services and related management, assistance/maintenance;
5. legal, safety/quality, accounting and tax consultants;
6. communication and marketing agencies;
7. Authorities and public bodies, even outside the purposes for which the data were initially collected.

Among the recipients of the data, the subjects who carry out processing operations on behalf of the Company as data controllers, pursuant to Article 28 of the GDPR, have been specifically authorized and instructed by the Company through a specific contractual agreement. The list of managers involved in the processing can be requested from the Company, which will make the relevant information available.

Transfer of data abroad (outside the EU and EEA)

There is no transfer of personal data outside the EU or European Economic Area (EEA). Should the transfer occur to countries outside the EU or the European Economic Area (EEA), this will take place, in any case, after verification of compliance with the provisions contained in articles 44 et seq. of the GDPR and prior communication regarding the third country of destination of the data and the safeguard mechanism based on the provisions of the GDPR.

Rights of interested parties

Navigators, users and customers can contact the Company or any external managers to exercise the rights provided for by the GDPR (articles 15 et seq.) and by the National Data Protection Laws as applicable, and, in particular, to access the own personal data, request rectification, updating or cancellation, limitations, as well as request portability, by sending a communication to the Company contact details indicated above.

Right of opposition

Users and customers may object, in whole or in part, to the processing of personal data concerning them, where the relevant legal basis is constituted by the legitimate interest of the Company, pursuant to and for the purposes of the provisions of Article 21 of the GDPR .

Complaint

Each interested party who believes that the processing of data concerning him or her is carried out in violation of the GDPR, in compliance with the provisions of Article 77 of the GDPR, may lodge a complaint with the supervisory authority where the interested party habitually resides or works or to a supervisory authority where the alleged data breach occurred.

Updates and revisions to the information

The Company reserves the right to modify and/or update the Information, also taking into account any subsequent additions and/or modifications to national and/or European Union regulations regarding the protection of personal data or as a result of any further purposes of data processing. For this reason the information is published with the progressive identification number and the month of publication. The new versions of the Information will replace the previous ones and will be valid, effective and applied from the date of publication on the Site or from the date of communication to the interested parties.