1. Data controller
The data controller is ABRITALY S.P.A. with registered offices in Lecco (LC), at Via Gorizia, 51 - 23900 (hereinafter the “Controller” or “Abritaly”).
2. Data processed
We use the information collected through the forms on the website www.abritaly.eu (hereinafter the “Site”) in order to better meet your expectations.
Please note that some replies are mandatory (those marked with an asterisk) in order for us to deal with your request, which we will not be able to process if you fail to provide us with the information needed.
Other replies are optional.
The data we collect include:
- Common, identifying data (such as first name, last name, gender) and contact details (postal address, e-mail address, phone number);
- Information on the request submitted and the project to be implemented (type of coverage, etc.);
- Browsing data.
Jointly referred to as 'Data'.
3. Purposes and legal bases of the processing
a) Implementation of pre-contractual measures taken at the request of the data subject.
The requested Data are collected in order to follow up the request and for the purposes of the correct management and fulfilment thereof ( for example, to provide you with all the information requested, send you a quotation proposal, and manage any subsequent stages of order execution and invoicing, etc.).
b) Fulfilment of a legal obligation to which the Controller is subject and the legitimate interest of the Controller to ascertain, exercise or defend its rights in court
The Controller may also process the Data in order to fulfil its obligations under applicable regulations and national and supranational legislation and, if necessary, to ascertain, exercise or defend the Controller's rights in court on the basis of its legitimate interest: this legitimate interest is to be considered overriding as it corresponds to a constitutionally guaranteed right and, as such, is socially recognised as overriding with respect to the interests of the individual data subject.
c) Explicit, optional and separate consent:
- i. Direct marketing by the Controller: to send you, via digital channels, promotional and commercial communications relating to services/products/events of the Controller, and/or to carry out market studies and statistical analyses;
- ii. Profiling and Profiled Marketing: to analyse your preferences, habits, behaviour, and inferred interests, in order to carry out targeted promotional actions;
- iii. Communication/transfer of your Data to WBA Group Companies: to enable these companies to send you promotional/commercial material.
The consent given for such processing will enable the Controller and the WBA Group companies to carry out these activities by means of a single centralised management system (CRM).
4. Mandatory nature of data provision
The provision of Data for the above-mentioned purposes a) and b), although optional, is mandatory in order to follow up your request and provide you with all relevant information.
Therefore, refusal to provide such Data will make it impossible for us to fulfil your request and allow you to benefit from the requested service (e.g. reply to a request for information, submission of an estimate, etc.).
The provision of Data for the purposes in point c) i, ii, and iii is instead entirely optional and revocable at any time. Any refusal in this case will not affect the proper management of the request made
5. Data recipients
For the purposes specified above, your Data will be processed by employees of the Controller, specifically designated as persons authorised to process such Data (such as people in the marketing department) and, subject to your consent, by the specifically designated staff of the companies of the WBA Group to which Abritaly belongs.
The Data may also be passed on to third parties where necessary for the establishment, management, execution and/or conclusion of the contractual relationship with the Controller. In this case, the third party recipients of the Data - whether autonomous data controllers or duly designated as data processors - belong to the following categories:
- external persons operating as autonomous data controllers such as Authorities and supervisory and control bodies and, in general, persons, including private individuals, entitled to request the data (such as accounting and legal consultants), and Public Authorities that expressly request such data for administrative or institutional purposes, in accordance with the provisions of current national and European regulations;
- persons unrelated to the Controller who provide services to the same and are useful for its activities (for example: IT service providers for database management, including contacts and e-mails, digital service providers and IT consultants who provide technical support to the Controller, third party web hosting service providers); these persons have been specifically appointed as data processors and their names are available from the Controller by sending a request to the contact details indicated below in the section 'Your Rights'.
6. Data retention
Data are processed only for the time strictly necessary to achieve the purposes for which they have been collected and, in any case, no longer than 12 months from the date of receipt of the request. This does not apply to the processing of Data for tax and/or social security audits and/or for obligations arising from the regulations applicable to the Controller, in relation to which the Data shall be kept for the retention period provided for by the applicable regulatory provisions, including tax regulations.
The Data collected and processed for the purposes in point c) i, ii, and iii will instead be processed - based on the average purchase frequency of the products provided by the Controller - for a period of 120 months after collection, and subsequently destroyed or made anonymous, in line with the technical procedures for deletion and backup and with the Controller's accountability requirements.
7. Place of processing
The Controller may transfer the Data concerned by this processing outside the European Union.
In particular, should such transfers be deemed necessary, for example in order to store the Data on servers and/or archives located outside the European Union, the Controller assures as from now that such operation will take place exclusively with persons established in countries that offer a level of protection similar to that guaranteed within the European Union, or subject to verification of the Standard Contractual Clauses approved by the European Commission pursuant to Art. 46(2)(c) and (d) GDPR or of the binding corporate rules referred to in Article 47 GDPR or, failing that, by virtue of one of the derogations referred to in Article 49 GDPR.
8. Your rights
Users of the Site, as data subjects (i.e., persons to whom the Data refer), have the rights set out in the GDPR. In particular, pursuant to Articles 15-22 GDPR, data subjects have the right to request and obtain, at any time, access to their personal data, information on the processing carried out, rectification and/or updating of personal data, cancellation and restriction of processing. They also have the right to object to the processing and to request data portability (i.e. to receive personal data in a structured, machine-readable, commonly used format). Finally, data subjects always have the right to revoke their consent at any time (this, in any case, will not affect the lawfulness of processing carried out on the basis of consent given before revocation) and to lodge a complaint with a supervisory authority (in Italy: the Garante per la Protezione dei Dati Personali).
The aforementioned rights may be exercised at any time, by simply submitting a request to the Controller to be sent:
- by e-mail, to email@example.com; or
- by post, to Via Gorizia 51, 23900 Lecco (LC).
Other information or clarifications on the rights mentioned above may be obtained by contacting Abritaly at the same addresses.
- 1. I declare that I have read the Privacy Statement on the processing of personal data, issued pursuant to Art. 13 of the European Regulation 2016/679 (GDPR) (mandatory)
- 2. I consent to direct marketing activities conducted by the Companies (optional)
- 3. I consent to the processing of my Data for the analysis of my preferences, habits, behaviours and interests, in order to receive targeted promotional offers from the Companies (optional)
- 4. I consent to my Data being passed on/transferred to WBA Group companies (optional)