Pursuant to art. 14 EU Regulation 2016/679.
Dear interested, Os-project.it online platform owned by Officine Svapo Srl, has the purpose of commercialize products (liquids and components for electronic cigarettes, accessories. legal hemp and derived products, such as oils and flavors of cbd). The cannabis products are sold in compliance with current legislation. We inform you that premixed liquids with and without nicotine have been removed from the site as they are not allowed to be sold to the public. Officine Svapo srl, has among its objectives the protection of personal data of its customers and users who access our websites, actual and / or potential. With the following, the “Information”, we intend to detail in depth how we intend to commit ourselves to ensure that the processing of personal data collected through this site is carried out in any manner, automated or manual, in full compliance with the rules and rights protection recognized by Regulation (EU) 2016/679 (hereafter, “GDPR” or “Regulations”) and by the applicable rules on the subject of personal data protection.
With the term personal data, reference is made to the definition contained in art. 4 in point 1) of the Rules, ie “any information concerning an identified or identifiable natural person; an identifiable natural person can be identified, either directly or indirectly, with particular reference to an identifier such as a name, an identification number, location data, an online ID or one or more characteristic elements of his physical identity, physiological, genetic, psychological, economic, cultural or social “(hereinafter, the” Personal Data “).
The Regulation provides that, before proceeding with the processing of Personal Data – with this term having to understand, according to the relevant definition contained in the art. 4 in point 2) of the Rules, “any operation or set of operations, performed with or without the aid of automated processes and applied to personal data or sets of personal data, such as the collection, registration, organization, structuring , storage, adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other form of making available, comparison or interconnection, limitation, cancellation or the destruction “(hereinafter, the” Treatment “) – it is necessary that the person to whom such Personal Data belong is informed about the reasons for which such data are requested and how they will be used. In this regard, this Notice – prepared on the basis of the principle of transparency and all the elements required by art. 14 of the Regulations – has the purpose to provide you, in a simple and intuitive way, all useful and necessary information so that you can give your Personal Data in a conscious and informed way and, at any time, request and obtain clarifications and / or corrections.
A. THE HOLDER OF THE TREATMENT
The company that will process your Personal Data for the main purpose referred to in Section C of this Information Notice and that, therefore, will play the role of data controller according to the relative definition contained in art. 4 in point 7) of the Regulations, ie “the natural or legal person, public authority, service or other body that, individually or together with others, determines the purposes and means of processing personal data” is:
• Officine Svapo Srl. (Hereinafter the “Owner”), with registered office in Via Moro 153 Travedona Monate (VA) (hereinafter the “Headquarters”). Tel: +39 339 696 8355 mail: firstname.lastname@example.org
B. CONTACTS OF THE PERSON RESPONSIBLE FOR THE PROTECTION OF PERSONAL DATA
In order to facilitate relations between you, as an interested part, as the “identified or identifiable natural person” referred to in the Personal Data pursuant to art. 4 in point 1) of the Regulations (hereinafter, the “Interested”) and the Data Controller, the Regulation has provided, in some specific cases, the appointment of a control and support figure who, among the various tasks assigned, also acts as a point of contact with the interested part.
Officine Svapo Srl has not adopted the figure of “responsible for data protection”, c.d. “Data Protection Officer”,
The Data Controller, in order to allow the purchase of products and / or the sending of requests for information using the contact forms and / or subscription to the newsletter service – needs to collect some of your Personal Data. The processing of your Personal Data will be conducted by the Owner to allow you to purchase the products sold on the site, receive newsletters, send requests for information, and take advantage of all other services, from time to time offered by the Internet site within which you are browsing. The processing of your Personal Data will be legally based on the contractual relationship that will be created between you and the Owner as a result of your acceptance of the conditions for participation on the Website, pursuant to art. 6, paragraph 1, point b) of the Regulations. To allow the Data Controller to carry out the processing activities for the purposes set out above, the provision of the Personal Data will be necessary. In the absence of the conferment of even one of the marked data, it will not be possible to proceed with the processing of your Personal Data and, consequently, it will not be possible to benefit from the services for which the provision of Personal Data is required. The Personal Data that will be required for the pursuit of the aforementioned purposes will be those indicated in the registration and / or contact form, that is, by way of non-exhaustive example: name, surname, date of birth, address of residence / residence , e-mail address, telephone numbers of fixed and / or mobile users.
D. ADDITIONAL PURPOSES
The Owner, in addition to the purposes referred to in the previous Section, may process your Personal Data for the following purpose: direct marketing: this term means the will of the Owner to carry out promotional and / or marketing activities for you. This category includes all the activities carried out to promote products, services, sold and / or provided by the owner, on the basis of his legitimate interest in pursuing his business purpose. With regard to the purpose of direct marketing, it should be noted that, pursuant to art. 6, paragraph 1, point f) of the Rules, the Owner may carry out this activity based on his legitimate interest, regardless of your consent and in any case up to your opposition or limitation (pursuant to Section H letter d) of this Information) to such processing as better explained in Recital 47 of the Regulation, in which “the processing of personal data for the purpose of direct marketing” is considered legitimate. This will also be possible following the assessments made by the Owner regarding the possible prevalence of your interests, fundamental rights and freedoms that require the protection of Personal Data on your legitimate interest in sending direct marketing communications. The contact modalities aimed at direct marketing activities can be both automated and traditional. In any case, and as detailed below in Section H, you can revoke your consent, even partially, for example by consenting to traditional methods of contact. As for the contact methods that involve the use of your telephone contacts, we remind you that the direct marketing activities by the Data Controller will be carried out after verification of your possible registration in the Register of Oppositions, as established pursuant to and for the effects of the Presidential Decree September 7, 2010, n. 178 and s.m.i.
E. SUBJECTS TO WHICH YOUR PERSONAL DATA WILL BE DISCLOSED
Your Personal Data may be disclosed to specific subjects considered recipients of such Personal Data. In fact, the art. 4 in point 9) of the Regulations, defines as the recipient of a Personal Data “the natural or legal person, the public authority, the service or another body that receives personal data, whether or not third parties” (of followed, the “Recipients”). With this in mind, in order to correctly perform all the Processing activities necessary to pursue the purposes set out in this Notice, the following Recipients may be in a position to process your Personal Data:
• third parties who perform part of the treatment and / or activities connected and instrumental to them on behalf of the Owner. These subjects have been appointed responsible for the processing, having to understand each other individually with this phrase, pursuant to art. 4 in point 8) of the Regulations, “the natural or legal person, public authority, service or other body that processes Personal Data on behalf of the Data Controller” (hereinafter the “Data Processor”);
• individuals, employees and / or collaborators of the Data Controller, who have been entrusted with specific and / or more processing activities on your Personal Data. These individuals have been given specific instructions on the safety and correct use of Personal Data and are defined, pursuant to art. 4 at point 10) of the Regulations, “persons authorized to process Personal Data under the direct authority of the Data Controller or Data Processor” (hereinafter, the “Authorized Persons”). If required by law or to prevent or suppress the commission of a crime, your Personal Data may be disclosed to public bodies or judicial authorities without being defined as Recipients. In fact, pursuant to art. 4 in point 9) of the Regulation, “public authorities that may receive communication of Personal Data in the context of a specific investigation in accordance with Union or Member State law are not considered Recipients”.
F. TREATMENT TIME
One of the principles applicable to the processing of your personal data concerns the limitation of the retention period, governed by art. 5, paragraph 1, point e) of the Regulation that states “the Personal Data are stored in a form that allows the identification of data subjects for a period of time not exceeding the achievement of the purposes for which they are processed; Personal Data may be stored for longer periods provided that they are processed exclusively for archival purposes in the public interest, scientific or historical research or for statistical purposes, in accordance with art. 89, paragraph 1, without prejudice to the implementation of adequate technical and organizational measures required by these Regulations to protect the rights and freedoms of the interested party “. In light of this principle, your Personal Data will be processed by the Data Controller only for what is necessary for the pursuit of the purpose set out in Sections C and D of this Information. In particular, as regards the purposes referred to in Section C, your Personal Data will be processed for a period of time equal to the minimum necessary, as indicated in Recital 39 of the Rules, ie until the termination of the contractual relations between you and the Owner and, subject to a further retention period which may be imposed by law as also provided for by Recital 65 of the Rules. With regard to the processing carried out for the achievement of the additional purpose referred to in Section D of this Information, the Data Controller may licitly process your Personal Data until you communicate, in one of the methods provided for in this Notice, your will to revoke or limit consent for the purpose of direct marketing. The possible revocation of the consent will in fact require Officine Svapo srl to cease the processing of your Personal Data for this purpose.
G. REVOCATION OF CONSENT
As required by the Regulations, if you have given your consent to the processing of your Personal Data for one or more purposes for which you have been requested, you can, at any time, withdraw it totally and / or partially without prejudice to the lawfulness of the treatment based on the consent given before the revocation. The methods of revoking consent are very simple and intuitive, just contact the Owner and / or the DPO using the contact channels reported in this information and respectively in Sections B and H.
As foreseen by the art. 15 of the Regulations, you can access your Personal Data, request correction and updating, if incomplete or erroneous, request cancellation if the collection was made in violation of a law or regulation, and oppose the processing for legitimate and specific reasons. In particular, we list below all your rights that you can exercise, at any time, against the owner. to. Right of access You will have the right, according to the art. 15, paragraph 1 of the Regulations, to obtain from the Owner confirmation that a Personal Data Processing is being processed and, in this case, to obtain access to such Personal Data and to the following information:
a) the purposes of the processing; b) the categories of Personal Data in question; c) Recipients or categories of Recipients to whom your Personal Data have been or will be communicated, in particular if Recipients of third countries or international organizations; d) whenever possible, the retention period of the Personal Data provided or, if not possible, the criteria used to determine this period; e) the existence of the right of the interested party to request the Data Controller to rectify or delete Personal Data or limit the processing of personal data concerning him or to oppose their processing; f) the right to lodge a complaint with a supervisory authority; g) if the Personal Data are not collected from the Data Subject, all information available on their origin; h) the existence of an automated decision-making process, including the profiling referred to in Article 22, paragraphs 1 and 4 of the Rules and, at least in such cases, significant information on the logic used, as well as the importance and expected consequences of such treatment for the interested party. All this information you can find in this information that will always be available to you within the Privacy section of the website. b. Right of rectification You can get, according to the art. 16 of the Regulations, the correction of your Personal Data that are incorrect. Taking into account the purposes of the processing, moreover, you can obtain the integration of your Personal Data that are incomplete, also by providing an additional declaration.
c. Right to cancel You can get, according to the art. 17, paragraph 1 of the Regulations, the cancellation of your Personal Data without undue delay and the Owner will have the obligation to delete your Personal Data, if there is even one of the following reasons: a) Personal Data is no longer necessary with respect to the purposes for which it was collected or otherwise processed; b) you have withdrawn the consent on which the processing of your Personal Data is based and there is no other legal basis for their processing; c) you opposed the treatment pursuant to art. 21, paragraph 1 or 2 of the Regulations and there is no longer any legitimate overriding reason to proceed with the processing of your Personal Data; d) your Personal Data has been processed unlawfully; e) it is necessary to delete your Personal Data in order to comply with a legal obligation provided for by a community or national law. In some cases, as foreseen by art. 17, paragraph 3 of the Regulations, the Holder is entitled to not delete your Personal Data if their processing is necessary, for example, for the exercise of the right to freedom of expression and information, for the fulfillment of a legal obligation, for reasons of public interest, for purposes of archiving in the public interest, scientific or historical research or for statistical purposes, for the assessment, exercise or defense of a right in court. d. Right to limit the processing You will be able to obtain the limitation of the treatment, according to the art. 18 of the Regulations, if one of the following hypotheses occurs: a) you have contested the accuracy of your Personal Data (the limitation will continue for the period necessary to the Data Controller to verify the accuracy of such Personal Data); b) The processing is illegal but you are opposed to the deletion of your Personal Data asking, however, that it is limited use; c) although the Data Controller no longer needs it for the purposes of processing, your Personal Data is used for the assessment, exercise or defense of a right in court; d) you are opposed to the treatment pursuant to art. 21, paragraph 1, of the Rules and you are awaiting the verification of the possible prevalence of the legitimate reasons of the Owner with respect to yours. In case of limitation of treatment, your Personal Data will be processed, except for storage, only with your consent or for the assessment, exercise or defense of a right in court or to protect the rights of a other natural or legal person or for reasons of significant public interest. We will inform you, in any case, before this limitation is revoked.
e. Right to data portability You can, at any time, request and receive, pursuant to art. 20, paragraph 1 of the Regulation, all of your Personal Data processed by the Data Controller in a structured format, in common and legible use or request transmission to another data controller without impediments. In this case, it will be your responsibility to provide us with all the exact details of the new data controller to whom you intend to transfer your Personal Data by providing written authorization. f. Opposition right In accordance with the art. 21, paragraph 2 of the Regulations and as also reiterated by Recital 70, you may object, at any time, to the processing of your Personal Data if these are processed for direct marketing purposes, including profiling in so far as it is related to such direct marketing . g. Right to lodge a complaint with the supervisory authority Without prejudice to your right to appeal to any other administrative or jurisdictional office, if you believe that the processing of your Personal Data conducted by the Data Controller is in violation of the Rules and / or applicable legislation, you can lodge a complaint with the Authority for the Protection of Personal Data competent. To exercise all your rights as identified above, simply contact the owner in the following ways: • sending an e-mail to the e-mail address email@example.com; • by sending a registered letter to the Office of Officine Svapo srl.
I. PLACES OF TREATMENT
Your Personal Data will be processed by the Owner within the territory of the European Union. If for technical and / or operational reasons it is necessary to make use of subjects located outside the European Union, we inform you from now on that.These subjects will be appointed as Data Processors pursuant to and for the purposes of art. . 28 of the Regulations and the transfer of your Personal Data to these subjects, limited to the performance of specific treatment activities, will be regulated in accordance with the provisions of Chapter V of the Rules. All necessary precautions will therefore be taken to ensure the fullest protection of your Personal Data based on this transfer: (a) on adequacy decisions of the third country recipients expressed by the European Commission; (b) on appropriate guarantees expressed by the recipient third party pursuant to Article 46 of the Rules; (c) on the adoption of binding corporate rules, c.d. binding corporate rules; (d) adopting standard contractual clauses approved by the European Commission. In any case, you can request more details from the Data Controller if your Personal Data have been processed outside the European Union requesting evidence of the specific guarantees adopted.