Information notice on the processing of personal data under EU Regulation no. 2016/679 (GDPR).
This notice does not apply to other websites that may be reached through links on the data controller’s websites; the data controller is in no way responsible for third-party websites.
As a result of consulting this website, data relating to identified or identifiable persons may be processed.
The “controller” of this processing is Dalmat Italia s.r.l. – Via del Perlar, 52 – 37135 Verona (VR) – Italy – VAT no. 03956080232 – REA no.: VR-379457.
Dalmat Italia s.r.l. and Sauna Smarty refer to the same entity which, as data controller, informs you pursuant to art. 13 of Legislative Decree 30.06.2003 no. 196 (hereinafter the “Privacy Code”) and art. 13 of EU Regulation no. 2016/679 (hereinafter the “GDPR”) that your data will be processed in the following ways and for the following purposes:
1. Subject of the processing
The Controller processes personal, identifying and non-sensitive data (by way of example but not limited to: first name, surname, company name, address, telephone, e-mail – hereinafter “personal data” or simply “data”) that you provide when registering on this website (hereinafter the “Site”), taking part in opinion and satisfaction surveys, filling in registration forms on the Site and making online requests.
2. Purposes of the processing
Your personal data are processed for the following Service Purposes:
- managing and maintaining the Site or giving you access to dedicated areas;
- allowing you to use any Services you may request;
- replying to online contact chats;
- guaranteeing you access to programmes and services;
- providing assistance and advice, including remotely;
- processing a contact request;
- for administrative and accounting activities in general;
- complying with obligations under the Law, a regulation, EU legislation or an order of the Authorities, or with requests from the Italian or a foreign government or from the Italian Chamber of Commerce;
- preventing or detecting fraudulent activities or abuses harmful to the Site;
- exercising the Controller’s rights, for example the right to take legal action.
3. Methods of processing and data retention period
Your personal data are processed by means of the operations listed in art. 4 of the Privacy Code and art. 4 no. 2) of the GDPR, namely: collection, recording, organisation, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, erasure and destruction of data. Your personal data are processed both on paper and electronically and/or automatically, through the use of a website hosted on the data controller’s server or on the sites of external companies that allow the data controller to offer its services (for example to offer online chat assistance or to upload files for the customer, providing the customer’s e-mail and name for downloading). The Controller will process personal data for the time necessary to fulfil the above purposes and in any case for no longer than 10 years from the end of the relationship for service purposes and no longer than 2 years from collection for other purposes. In accordance with art. 5 paragraph 1 letter e) of EU Reg. 2016/679, the personal data collected will in any case be kept in a form that allows the identification of data subjects for no longer than is necessary to achieve the purposes for which the personal data are processed.
4. Security
The Controller has adopted a wide range of security measures to protect your data against the risk of loss, misuse or alteration. In particular, it has adopted the measures set out in arts. 32-34 of the Privacy Code and art. 32 of the GDPR. Where necessary for more secure communications, it uses data encryption technology based on the AES (BCrypt) standards and the secure data transmission protocols known as HL7 and HTTPS.
5. Access to data
Your data may be made accessible for the purposes referred to in art. 2.A) and 2.B):
· to employees and collaborators of the Controller, in their capacity as persons in charge and/or internal data processors and/or system administrators;
· to third-party companies or other parties (website provider, cloud provider, e-payment service provider, suppliers, hardware and software support technicians, forwarders and carriers, credit institutions, professional firms, etc.) that carry out outsourced activities on behalf of the Controller, in their capacity as data processors.
6. Communication of data
Without your express consent (pursuant to art. 24 letters a), b), d) of the Privacy Code and art. 6 letters b) and c) of the GDPR), the Controller may communicate your data for the purposes referred to in art. 2.A) to Supervisory Bodies and Judicial Authorities, as well as to all other parties to whom communication is required by Law. In any case, we assure you that your personal data will never be made public on the controller’s website.
7. Data transfer
Personal data will be managed and stored in Europe, on servers located in Italy belonging to the Controller and/or to third-party companies, including abroad, appointed and duly designated as data processors for the use of the requested services. The personal data provided may be transferred abroad, within and outside the European Union, within the limits and under the conditions set out in arts. 44 et seq. of EU Regulation 2016/679, in order to fulfil purposes connected with such transfer.
8. Nature of the provision of data and consequences of refusing to respond
The provision of data for the purposes referred to in art. 2.A) is mandatory. Without it, we will not be able to guarantee you either registration on the Site or the Services referred to in art. 2.A).
You may therefore decide not to provide any data or to subsequently refuse the processing of data already provided. In any case, you will continue to be entitled to the Services referred to in art. 2.A).
9. Rights of the data subject
As data subjects, you have the rights set out in art. 7 of the Privacy Code and art. 15 of the GDPR, namely the rights to:
· I) obtain confirmation of whether or not personal data concerning you exist, even if not yet recorded, and their communication in an intelligible form;
· II) obtain information on: a) the origin of the personal data; b) the purposes and methods of the processing; c) the logic applied in the case of processing carried out with the aid of electronic tools; d) the identification details of the controller, the processors and the representative designated pursuant to art. 5, paragraph 2 of the Privacy Code and art. 3, paragraph 1 of the GDPR; e) the parties or categories of parties to whom the personal data may be communicated or who may learn of them as designated representative in the territory of the State, processors or persons in charge;
· III) obtain: a) the updating, rectification or, where you have an interest, the integration of the data; b) the erasure, anonymisation or blocking of data processed unlawfully, including data whose retention is not necessary for the purposes for which they were collected or subsequently processed; c) certification that the operations referred to in letters a) and b) have been brought to the attention, including as regards their content, of those to whom the data were communicated or disseminated, except where this proves impossible or involves a manifestly disproportionate effort compared with the right protected;
· IV) object, in whole or in part: a) on legitimate grounds, to the processing of personal data concerning you, even if relevant to the purpose of collection; b) to the processing of personal data concerning you for the purpose of sending advertising material or direct selling or for carrying out market research or commercial communication, through the use of automated calling systems without the intervention of an operator, by e-mail and/or through traditional marketing methods by telephone and/or paper mail. Please note that the data subject’s right to object, set out in point b) above, for direct marketing purposes through automated methods extends to traditional methods, and that the data subject may in any case exercise the right to object only in part. The data subject may therefore decide to receive only communications through traditional methods, only automated communications, or neither type of communication.
Where applicable, you also have the rights set out in arts. 16-21 of the GDPR (right to rectification, right to be forgotten, right to restriction of processing, right to data portability, right to object), as well as the right to lodge a complaint with the Data Protection Authority.
10. How to exercise your rights
You may exercise your rights at any time by sending:
· a registered letter with return receipt to the company’s registered office, at the address given at the beginning;
· an e-mail to [email protected]
11. Minors
This Site and the Controller’s Services are not intended for minors under 18 years of age, and the Controller does not knowingly collect personal information relating to minors. Should information on minors be recorded unintentionally, the Controller will delete it promptly at the users’ request.
12. Controller, processor and persons in charge
The Controller / Processor (pursuant to arts. 4, 24, 28 of EU Reg. 2016/679) is Dalmat Italia s.r.l. – Via del Perlar, 52 – 37135 Verona (VR) – Italy – VAT no. 03956080232 – REA no.: VR-379457.
13. Changes to this Notice
This Notice may be subject to change. We therefore recommend that you check it regularly and refer to the most up-to-date version.
—— FURTHER POLICIES AND AGREEMENTS ——
Confidentiality agreement for all information provided by our customers and site users
The data controller hereby declares that it is aware that, as a result of its working relationship with customers and/or advice, including free advice, given to site users who contact the controller by e-mail, chat or other communication channels, it may come to know data, information and news in general of a confidential nature, and undertakes to maintain the strictest confidentiality regarding what it receives, as well as any other news, confidence and/or information, in the broadest sense of the term, learned about and/or from the customer or site user.
COPYRIGHT OF TEXTS AND CONTENT
The graphics, layout, texts, videos and code of this site may not be reproduced, even in part, on other websites, mailing lists, newsletters, printed magazines or CD-ROMs without the prior authorisation of the data controller.
