PRIVACY POLICY in accordance with Articles 13 and 14 of EU Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation or "GDPR")

The purpose of this document is to inform you about how Essedi S.p.A. processes your personal data when you make a purchase in-store or via our e-commerce platform, which can be accessed via the website https://www.antonymorato.com/it/ 

Customers

  1. Data Controller and Data Protection Officer (DPO)

In accordance with and for the purposes of Regulation (EU) 2016/679 on the protection of personal data ("GDPR") and any other applicable national and/or EU provisions on the protection of personal data (including Italian Legislative Decree 196/2003 – the "Privacy Code"), - the company Essedi S.p.a. with its registered office at Via Tortona 37, Milan (MI), CAP 20144 – website: https://www.antonymorato.com/it/company/, email: privacy@antonymorato.it hereby wishes to inform you of the purposes and procedures for the processing of personal data collected, the scope of their disclosure and distribution, as well as the nature of their provision.

The Company has appointed a Data Protection Officer (DPO) from the law firm Studio Legale Imperiali e Associati, represented by Marzia Imperiali of Francavilla, in the person of lawyer Diego Cordua, who may be contacted for any queries regarding the processing of personal data via the following channel dpo@antonymorato.it

 

  1. Purpose and legal basis of processing

The company collects and processes personal data, including through the use of information technology and telecommunications systems, for the following purposes:

  1. The management of the contractual relationship, including the purchase of products from branded stores, the purchase of products via the e-commerce portal, registration for or use of the services provided by the website, and membership of the loyalty programme; or to enable the fulfilment of the obligations under the main contract. The legal basis for the processing is set out in Article 6, paragraph 1, letter b) of the GDPR.
  2. Compliance with legal obligations relating to the contract; the legal basis for this processing is compliance with obligations laid down by law or by EU legislation (Article 6, paragraph 1, letter c) of the GDPR)
  3. Protection of rights before the competent authorities in the event of disputes or complaints; the legal basis for this processing is the company’s legitimate interest in safeguarding its rights (Article 6, paragraph 1, letter f) of the GDPR).
  4. Promotional purposes
  1. This may include commercial communications or the sending of advertising material, or direct sales activities, the carrying out of market research using traditional contact methods – by post or telephone – or automated methods – such as text messages, WhatsApp, faxes or automated calls; you may also withdraw any consent previously given at any time, even partially, for example by consenting only to traditional contact methods (Legal basis: Article 6, paragraph 1, letter a) of the GDPR);
  2. In accordance with Article 130, paragraph 4 of Italian Legislative Decree 196/2003 and subsequent amendments, Essedi S.p.A. may legitimately use – without being required to obtain your prior consent – the email address you provided at the point of purchase in order to promote products and/or services similar to those you have previously purchased. In any case, the exercising of your right to object to the processing in question is guaranteed at any time by using the opt-out mechanism provided for in the communications you will receive, or by sending an email (preferably from the address with which you registered) to privacy@antonymorato.it or to the address of the DPO dpo@antonymorato.it with the request to unsubscribe.
  1. Profiling purposes: such as the identification of purchasing habits and propensities, with reference to the information acquired through this form, to better customise the services provided, meet your needs with beneficial promotions, and propose new services and products (Legal basis: Article 6, paragraph 1, letter a) of the GDPR.

 

  1. Categories of personal data

The data being processed, which is collected during the pre-contractual phase, at the time the contractual relationship is entered into and throughout its duration, falls within the category of so-called "common" data.

In particular:

  • personal and contact details (e.g., first name, surname, email address, telephone number) will be processed for promotional and profiling purposes
  • personal and contact details, tax registration number, billing details, payment details and the shipping address for the products will be processed for purposes relating to the management of the contractual relationship.

In the case of legal persons, the data indicated above may refer to legal representatives, employees or collaborators. In the latter case, the customer company (or potential customer) undertakes, therefore, to ensure that the data subject (legal representative or employee/collaborator) – where this is not the same person as the individual providing the personal data – is fully aware of the key elements of this privacy notice.

  1. Nature of the provision

The provision of personal data for the purposes indicated in points a), b) and c) of paragraph 1 is necessary for the conclusion and proper performance of the contract; without it, it will not be possible to establish any contractual relationship or to properly fulfil the obligations and commitments arising therefrom.

For the purposes referred to in points d) and f) of the previous paragraph, the provision of your consent is optional, and any objection to the processing of your data will not affect the conclusion or performance of the contract.

 

  1. Methods of data processing and retention times

For each of the purposes set out above, your personal data will be processed by automated and/or manual means and, in any event, in such a way as to ensure the security and confidentiality of such data.

This data is retained by the Data Controller for the period necessary to fulfil the contract and/or the pre-contractual measures for which the data was collected.

Personal data will not be distributed. The company does not base its decision-making processes solely on automated processing.

With regard to the aforementioned promotional and profiling purposes, the data will be retained for a maximum of 36 months, based on a data protection assessment carried out by the Data Controller, while for contractual purposes, the data will be retained for the period required by law (a maximum of 10 years, for administrative and accounting purposes, in accordance with Article 2220 of the Italian Civil Code). Once these time limits have expired and the Company no longer has any need to retain the information in order to comply with potential tax audits, the data is destroyed, deleted or rendered unreadable, provided there are no further requirements justifying its retention (e.g., pending legal disputes).

 

  1. Scope of data processing

The data may be used by the Company's personnel who have been assigned a specific role as data processors and who have been given appropriate operational instructions, in accordance with Article 29 of the GDPR and Article 2-quaterdecies of the Privacy Code, as well as by third-party companies that carry out ancillary activities on behalf of the Company (e.g., communications agencies, email marketing platforms, etc.). The latter act as data processors and operate under the direction and supervision of Essedi S.p.A. by virtue of specific agreements (DPAs – Data Processing Agreements) entered into in accordance with Article 28 of the GDPR. The updated list of data processors is available on request by emailing privacy@antonymorato.it  

Your personal data may also be disclosed to independent third-party data controllers such as lawyers, consultants and competent authorities and police forces if necessary (e.g., in the event of complaints regarding products purchased or for the detection of fraud or other offences and the protection of rights, as well as where it is mandatory as per applicable laws).

Your data may be transferred abroad for the performance of activities carried out on behalf of the company and processed by entities falling within the categories mentioned above and located within the European Union.

If, for technical and/or operational reasons, it is necessary to use subjects located outside the European Union, or it is necessary to transfer some of the data collected to technical systems and services managed in the cloud and located outside the European Union area, the processing will be regulated in accordance with the provisions of Chapter V of the GDPR. All necessary precautions will therefore be taken to ensure the fullest protection of personal data by basing such transfer: a) on decisions regarding the adequacy of the recipient third countries expressed by the European Commission; b) on adequate guarantees expressed by the recipient third party in accordance with Article 46 of the GDPR.

 

  1. The rights of data subjects

In accordance with Articles 15–21 of the Regulation, the data subjects (you if you are a natural person or the legal representatives/staff of the legal person customer) have the right to

  • receive confirmation of the existence of personal data, to access its content and to obtain a copy (right to access);
  • update, modify and/or correct personal data (right to rectification);
  • to request the erasure of the data when it is no longer necessary or consent has been withdrawn and the data is not required for any other purpose, or in the event of an objection to its use for the purposes referred to in point 2 d), or because this is required by law or the data is being processed in breach of the law (right to deletion);
  • request the limitation of the data processing pending a dispute (accuracy of the data, data processed unlawfully or opposition) and in the event of exercising the rights of defence (right to limitation);
  • revoke consent, where given, at any time and without prejudice to the lawfulness of processing based on consent given prior to such revocation (right to withdrawal of consent);
  • receive a copy of any personal data in electronic format, provided in connection with contractual relationships or on the basis of your consent, and to request that such data be transferred to another data controller (right to data portability).

The data subject also has the right to object to the use of data by the Company at any time in accordance with the provisions of the Regulation (right to opposition), providing evidence of the reasons justifying the opposition, and to submit a complaint to the competent supervisory authority in accordance with Article 77 of the GDPR (the Italian Data Protection Authority), or to seek legal redress in accordance with Article 79 of the GDPR.

 

You may exercise your rights, including the right to object to the processing of your data for promotional purposes, at any time by writing to the contact details set out in point 1 above or by sending a registered letter with acknowledgement of receipt to the following address: Via Tortona 37, Milan (MI) – CAP 20144.