Privacy notice for collecting the personal data of Customers / Suppliers/Contacts (Natural Persons)
PRIVACY NOTICE PURSUANT TO ARTICLES 13 AND 14 OF REGULATION (EU) 2016/679
Pursuant to articles 13 and 14 of Regulation (EU) 2016/679 (the “Regulation”), Andrew Srl, in its capacity as Data Controller, would like to inform Customers, Suppliers and potential Customers (the “Data subjects”), that the personal data concerning them (the “Data”) will be processed lawfully, fairly and in a transparent manner, by the methods and for the purposes illustrated below
- Sources of personal data
The data processed concern citizens and are collected, directly by ANDREW SRL and/or through specifically designated third parties, from Data subjects and/or from third parties, including through remote communication techniques used by Andrew Srl. The data concern Natural Persons (citizens) and are mainly name and address, contacts, email, tax code and identification details.
- Purposes and legal basis of the processing
The data are processed for managing the contractual or pre-contractual relationship, for administrative and accounting purposes and for complying with the associated obligations.
The contact data requested by the web platform such as email, address and telephone number are not obligatory; they may be collected with your consent, and are optional for contacting you in future and for any marketing campaigns also undertaken by means of periodic mailing lists.
The data may be communicated to our suppliers and partners, accountants, business consultants, banking and financial institutions, IT support companies, law firms for defence in a court of law, external studios, external professionals and collaborators used for marketing and communication.
Refusal to provide data or to give consent for processing will make it impossible to establish or continue the contractual or pre-contractual relationship but will not have any further negative consequences.
Consent to processing may be revoked at any time, without prejudice to the lawfulness of the processing carried out up to that time.
- Methods of processing personal data
The data are processed by manual, computerised and electronic means, with logic strictly related to the purposes stated above and, in any case, in compliance with the safeguards, guarantees and necessary measures prescribed by the reference regulation. These measures are aimed at ensuring the confidentiality, integrity and availability of the Data, as well as preventing damage, both material and immaterial (e.g. loss of the control of personal data or limitation to rights, discrimination, fraudulent use or identity theft, financial loss, damage to reputation, loss of privacy of personal data protected by professional confidentiality or any other significant economic or social damage).
- Special and sensitive data
With regard to the purposes stated in point 2, Andrew Srl does not process any of your data that may be considered “sensitive”. For the contractual or pre-contractual relationship your express consent will be requested where necessary.
For the processing undertaken through the web platform (initial contact data) automatic profiling tools such as Google Analytics will be used, with information, for example, on your location and your computer platform. For more details see the notice made available and published on the company website.
Consent to the processing of multimedia data for marketing and advertising purposes is explicit and voluntary and any refusal to such processing will not entail any negative consequences.
- Transfer of data to countries and organisations outside the EU
Where necessary, to achieve the purposes stated in paragraph 3, the Data subject’s data may be transferred abroad to EU and non-EU countries or to organisations that guarantee a level of protection of personal data considered adequate by the European Commission based on its own decision or in any case based on other appropriate guarantees, such as for example the Standard contractual clauses adopted by the European Commission.
A copy of any Data transferred abroad, as well as a list of non-EU countries and organisations to which the Data have been transferred may be requested from the Data Controller, using the contact details given in paragraphs 8 and 9 to follow.
- Categories of persons to whom personal data may be communicated or who may gain knowledge of them
To achieve the purposes described in paragraph 3, Andrew Srl reserves the right to communicate the Data to recipients belonging to the following categories:
- Associated partners and companies for commercial, technical and logistic needs;
- Accountants, Business consultants and Law firms;
- External consultants for marketing and communication activities;
- Supervision and Control bodies and authorities and, in general, public or private entities, with important public law functions (but in any case, only where the prerequisites exist as set out in the applicable law);
- Professionals, professional firms or companies whose services are necessary for contractual or pre-contractual relationships;
- Banking, credit and financial institutions,
- Individuals involved in the control, auditing and certification of the activities carried out by ANDREW SRL
Individuals belonging to the above categories who may work independently as separate Data Controllers or as Data Protection Officers appointed by Andrew Srl, of which a continuously updated list is kept by Andrew Srl.
The Data may also come to the knowledge of employees of Andrew Srl as a result of the roles assigned to them, including interns, temporary workers, consultants, all specifically appointed or in charge of processing.
- Storage and erasure of personal data
As provided for by art. 5 paragraph 1 letter e) of the Regulation, the Data will be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed. After this time, the data will be erased, unless they need to be kept for a longer time to perform legal obligations or to comply with orders issued by Public Authorities or Supervisory bodies.
- Rights of the Data subject
In accordance with articles 15 to 22, the Regulation gives Data subjects the possibility of exercising certain rights.
In particular, the Data subject can obtain: a) confirmation as to whether or not personal data concerning him or her are being processed, and, if that is the case, access to such data; b) rectification of inaccurate personal data and the right to have incomplete personal data completed; c) erasure of personal concerning him or her, on the grounds permitted by the Regulation; d) restriction of processing, under the circumstances permitted by the Regulation; e) communication to recipients to whom the personal data have been or will be disclosed of the Data subject’s request for the rectification/erasure of personal data and the restriction of processing, unless this would involve disproportionate effort; f) the right to receive, in a structured, commonly used and machine-readable format, the personal data supplied to the Controller, as well as having these transferred to another Data Controller, at any time, including upon the cessation of any relationships with the Controller.
The Data subject shall also have the right to object to the processing of his or her personal data, at any time: in such cases, the Controller must cease any further processing, unless on the grounds permitted by the Regulation.
The data subject furthermore has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her, unless this decision: a) is necessary for entering into, or performing a contract between the Data subject and the Data Controller; b) is authorised by Union or Member State law to which the controller is subject; c) is based on the Data subject’s explicit consent. In the cases referred to in points a) and c) of paragraph 2, the Data subject shall have the right to obtain human intervention on the part of the Controller, to express his or her point of view and to contest the decision.
Requests may be made to the organisational department designated to deal with such matters by the Data subject, by ordinary post sent to the Controller’s head office or by email to privacy@andrewshoes.com
The Data subject furthermore has the right to lodge a complaint with the supervisory authority – the “Garante della Privacy”.
An updated version of this privacy notice can be found on the web page: www.andrewshoes.com/it/privacy
- DATA CONTROLLER
The Controller of the personal data is Andrew Srl with head office in Via E. Fermi 11, Montebelluna (TV)
|
CONSENT TO PROCESSING Regulation UE 679/2016 on matters of privacy and data protection
I, the undersigned ……………………………………………………………………………………….born in ……………………………………………… …………………………………………………………….on ……………………………………………….resident in ……………………………………………… …………………………………………………………………………………………………………..……………………………………………………………………… HEREBY GIVE MY CONSENT AND AUTHORISE □ the processing of my general personal data, solely for the purposes and by the methods described in the privacy notice that I have read fully and understood.
□ the processing of my multimedia data (photo, video, audio), for marketing and advertising purposes including on social networks and company web pages, solely for the purposes and by the methods described in the privacy notice that I have read fully and understood.
Date ……………….. Signed ……………………………………………..
|