PRIVACY POLICY

(updated to gdpr 679/2016)

INTRODUCTION
Natali Alessandro & Co. S.p.a., with registered office in Via Taviani 170 - 19125 La Spezia (SP) - Italy - VAT number: 00787580117
(hereinafter, "Holder"), as data controller, informs you pursuant to art. 13 of Legislative Decree no. 196 of 30 June 2003 (hereinafter, "Privacy Code") and art. 13 of EU Regulation no. 2016/679 (hereinafter, "GDPR") that your data will be processed in the manner and for the following purposes:

1) Object of the treatment
The Data Controller processes personal, identifying and non-sensitive data (in particular, name, surname, tax code, VAT number, email address, telephone number - hereinafter, "personal data" or even "data") communicated by you when registering on the Data Controller's website and/or when subscribing to the newsletter service offered by the Data Controller.

2) Purpose of the treatment
Your personal data are processed:
A) Without your express consent (art. 24 letter a, b, c Privacy Code and art. 6 letter b, and GDPR), for the following Service purposes:

• To allow subscription to the newsletter service provided by the Owner and any other services requested by you;
• Fulfil the pre-contractual, contractual and fiscal obligations arising from the relationship with you;
• Fulfill the obligations provided for by law, regulation, Community legislation or an order of the Authority;
• Preventing or detecting fraudulent activities or abuses harmful to the website;
• Exercise the rights of the Owner, for example the right of defense in court.

B) Only with your specific and distinct consent (Articles 23 and 130 of the Privacy Code and Article 7 of the GDPR), for the following Marketing Purposes:

• Send you by email newsletters, commercial communications and / or advertising material about products or services offered by the Owner. Please note that if you are already our customer, we may send you commercial communications relating to services and products of the Holder similar to those of which you have already used, unless his dissent (art. 130 c. 4 Privacy Code).

3) Methods of treatment
The processing of your personal data is carried out by means of the operations indicated in art. 4 Privacy Code and art. 4 n. 2) GDPR, namely: collection, recording, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, cancellation and destruction of data. Your personal data will be processed on paper, electronically and automatically.
The Owner will process personal data for the time necessary to fulfill the above purposes and in any case for no more than 10 years from the termination of the relationship for the Service Purposes and for no more than 2 years from the collection of data for the Marketing Purposes.

4) Access to data
Your data may be made accessible for the purposes referred to in art. 2:

• To employees and collaborators of the Data Controller, in their capacity as persons in charge and/or internal data processors and/or system administrators;
• To external companies for support activities in the study of the feasibility of the customer's project, for activities of technical management of the project, for the storage of personal data, etc..) or to third parties (for example, providers for the management and maintenance of the website, suppliers, credit institutions, professional firms, etc.) who perform activities in outsourcing on behalf of the Owner, in their capacity as external data controllers.

5) Communication of data
Without his express consent (ex art. 24 letter. a), b), d) Privacy Code and art. 6 letter. b) and c) GDPR), the Owner may communicate his data for the purposes referred to in art. 2. A) to supervisory bodies, judicial authorities and all other persons to whom communication is required by law for the performance of these purposes. Your data will not be disclosed.

6) Data transfer
Personal data will be managed and stored on servers located within the European Union by the Owner and/or by third party companies appointed and duly appointed as Data Processors. Our servers are currently located in France. The data will not be transferred outside the European Union. In any case, it is understood that the Owner, if necessary, will have the right to move the location of the servers in Italy and/or European Union and/or non-EU countries. In this case, the Data Controller hereby guarantees that the transfer of the non-EU data will take place in accordance with the applicable legal provisions, stipulating, if necessary, agreements guaranteeing an adequate level of protection and/or adopting the standard contractual clauses provided for by the European Commission.

7) Nature of data provision and consequences of refusal to answer
The provision of data for the purposes referred to in art. 2. In their absence, we can not guarantee neither the registration to the site nor the Services of art. 2. The provision of data for the purposes referred to in Article. 2. You may therefore decide not to provide any data or subsequently deny the possibility of processing data already provided: in this case, you may not receive newsletters, commercial communications and advertising material relating to the Services offered by the Owner. In any case, you will continue to be entitled to the Services referred to in art. 2.

8) Rights of the interested party
As a data subject, you have the rights under Art. 7 of the Privacy Code and Art. 15 of the GDPR, namely the rights to:

A) Obtain confirmation of the existence or not of personal data concerning you, even if not yet recorded, and their communication in intelligible form;
B) Obtain the indication:

• The origin of the personal data;
• The purposes and methods of processing;
• The logic applied in case of processing carried out with the help of electronic means;
• The identification data concerning the data controller, the data processors and the representative designated pursuant to art. 5, paragraph 2 of the Privacy Code and art. 3, paragraph 1 of the GDPR; and the subjects or categories of subjects to whom the personal data may be communicated or who may become aware of it in their capacity as designated representative in the territory of the State, data processors or persons in charge of the processing;

C) Obtain:

• Updating, rectification or, when interested, integration of data;
• The cancellation, transformation into anonymous form or blocking of data processed unlawfully, including data whose retention is unnecessary for the purposes for which the data were collected or subsequently processed;
• and B) have been notified, also as regards their content, to those to whom the data were communicated or disseminated, unless this requirement proves impossible or involves a manifestly disproportionate to the protected right;

D) Opposites, in whole or in part:

• For legitimate reasons to the processing of personal data concerning him, even if pertinent to the purpose of collection;
• The processing of personal data concerning you for the purpose of sending advertising materials or direct selling or for carrying out market research or commercial communication, through the use of automated calling systems without the intervention of an operator by email and / or traditional marketing methods by telephone and / or mail. It should be noted that the right of objection of the person concerned, as set out in point B) above, for direct marketing purposes by means of automated methods extends to traditional ones and that, in any case, the possibility for the person concerned to exercise the right of objection even in part remains unaffected. Therefore, the interested party may decide to receive only communications by traditional means or only automated communications or neither of the two types of communication.
• Where applicable, he also has the rights under Articles. 16-21 GDPR (Right of rectification, right to be forgotten, right to limitation of processing, right to data portability, right of opposition), as well as the right of complaint to the Guarantor Authority.

 

9) Modalities of exercise of the rights
You may at any time exercise your rights by sending:

• A registered letter with return receipt addressed to: Natali Alessandro & Co. S.p.a. - Via Taviani 170 - 19125 La Spezia (SP) - Italy
• An e-mail/PEC at natalicompany@legalmail.it

 

10) Minors
This site and the services of the Holder are not intended for children under 18 years of age and the Holder does not intentionally collect personal information relating to minors. In the event that information on minors is unintentionally recorded, the Owner will delete it in a timely manner, at the request of users.

11) Owner, manager and persons in charge
The Data Controller is Natali Alessandro & Co. S.p.a., with registered office in Via Taviani 170 - 19125 La Spezia (SP) - Italy. The updated list of data processors and persons in charge of data processing is kept at the headquarters of the Data Controller.

12) Changes to this Policy
This Policy may be subject to change. We therefore recommend that you check this information regularly and refer to the latest version.