Article 13 of EU Regulation 679/2016
Rev. May 2023
In compliance with European Regulation No. 679/2016 (hereinafter referred to as the "Regulation") and national laws on the protection of personal data (hereinafter collectively referred to as the "Privacy Regulations"), CERAMICHE BUCCI S.R.L. wishes to invite you to carefully read this Privacy Notice, which contains important information regarding the protection of your Personal Data. The processing of your Personal Data will be based on the principles of fairness, lawfulness, transparency, purpose and storage limitation, data minimization and accuracy, integrity and confidentiality, in accordance with the provisions of the Regulation.
1. DATA CONTROLLER
The Data Controller responsible for the processing of Personal Data is Ceramiche Bucci S.R.L. (hereinafter "Ceramiche Bucci" and/or "Controller"), with registered office at Strada della Romagna, 143 - 61121 Pesaro, represented by its legal representative pro tempore.
2. DATA PROTECTION OFFICER - DPO
In compliance with the provisions of the Regulation, the Data Controller has appointed a Data Protection Officer (DPO) with the task of ensuring compliance with the Regulation and serving as a point of contact for data subjects as well as the Supervisory Authority for the protection of personal data. The DPO can be contacted at the email address firstname.lastname@example.org.
3. DATA PROCESSORS
Your Personal Data may be processed by companies acting as Data Processors on behalf of Ceramiche Bucci S.R.L., carrying out activities related to the processing of Personal Data. The Controller has prepared an updated list of Data Processors, which can be consulted by contacting the contact details indicated in section 12 of this Privacy Notice.
4. PROCESSED PERSONAL DATA
• Your identifying data (name and surname), your contact details (email address, address, and telephone number), shipping address, billing address, payment data (payment method used, cardholder, card number). These data are processed in relation to the online sale of Ceramiche Bucci products and related activities (e.g., conclusion and execution of the contract, payment, invoice issuance, product shipment, management of the right of withdrawal, returns and legal warranties, customer support, fraud control and prevention - including third-party behaviour - in compliance with applicable laws, contractual provisions, fairness and good faith), as well as for the following services offered through the Website in relation to online sales. For customer support activities, the information you choose to provide in your communications is also processed.
• If you register on the Website - in the "Account" area - your identifying data, email address (your password is encrypted and therefore not visible to us), as well as the data necessary to provide you with services reserved for registered users (e.g., Wish List, My Orders, etc.) are processed.
• Your identifying and contact data are also used by Ceramiche Bucci to manage any requests for information regarding Ceramiche Bucci products.
• Your identifying and contact data may be processed when you have given consent to receive marketing communications from Ceramiche Bucci via phone, email, or other means.
• When you have given the corresponding consent, Ceramiche Bucci also processes data related to your preferences and interests, such as products you have purchased or added to your Wishlist, age and gender, your country of residence, preferred language and currency, newsletters you have subscribed to, and your interaction with them and Ceramiche Bucci events. Ceramiche Bucci processes your data to analyse your habits and preferences in order to offer personalized services and communications that align with your interests.
• Identifying data (name and surname), contact data (email address, postal address, and telephone number) are processed when a user of the Website provides us with such information for the delivery of products purchased on the Website. The data is used exclusively to fulfill the user's request and not for other purposes (such as marketing activities). If you provide us with personal data of third parties, we kindly ask you to ensure compliance with applicable laws by informing the third parties beforehand and obtaining their consent for the processing, if required.
• In case of submitting requests through the "Contact Us" section of Ceramiche Bucci S.R.L.'s Website, the provision of certain Personal Data is necessary to respond to the requests. Therefore, the corresponding fields in the registration form are marked as mandatory.
• In addition to the aforementioned categories of Personal Data, we may process additional data directly provided by you (referred to as "Contributions") and shared on the social network pages dedicated to Ceramiche Bucci S.R.L. (such as Facebook, Twitter, Instagram, etc.), such as likes, comments, images, and in general any content or information you publish on the social network pages dedicated to the products of the Ceramiche Bucci S.R.L. brand.
• Photographs and/or video recordings may be collected on the occasion of participating in promotions, contests, institutional events, exhibitions, shows, museum contexts, and general installations.
5. PURPOSES AND LEGAL BASIS OF PROCESSING
In relation to accessing the various sections of the Ceramiche Bucci S.R.L. Website (subject to specific initiatives that require the provision of specific personal data, for which detailed information will be provided), the purposes of processing personal data and their respective legal bases are indicated below:
• Website registration: The registration procedure, through the creation of an account, allows the use of the Ceramiche Bucci S.R.L. portal as a "Registered User" and grants access to a range of exclusive services offered through the same applications. The provision of data is optional. The legal basis for processing is the performance of pre-contractual measures in which the data subject is involved.
• Product purchase: Through our website, you can purchase Ceramiche Bucci S.R.L. products as a Registered User (without the need to re-enter all your personal data for each purchase), which will involve the processing of your personal data for managing orders and payments, as well as fulfilling administrative and accounting obligations and contacting you for communications related to the purchases (e.g., order status updates). The provision of data is necessary to complete the purchase order. The legal basis for such processing is the performance of the contract in which the data subject is involved.
• Customer support: The processing is necessary for the performance of a contract to which you are a party (provision of support). The provision of your personal data is mandatory; failure to provide it will result in the inability to receive the requested assistance. The legal basis for such processing is the performance of the contract in which the data subject is involved.
• Compliance with legal obligations related to sales activities (e.g., invoice issuance and retention): This processing is necessary to comply with a legal obligation. The provision of your personal data is, therefore, mandatory; failure to provide it will prevent you from making a purchase on the Website. The legal basis for such processing is the performance of the contract in which the data subject is involved.
• Prevention and detection of fraud and abusive behaviors (including those of third parties) that contravene applicable laws, contractual provisions, fairness, and good faith. The lawfulness of this processing is based on a legitimate interest aimed at carrying out checks and security activities to prevent and protect against fraudulent activities and abusive behaviors. Upon your request, we will provide you with detailed information regarding this legitimate interest and the related balancing test. The legal basis for this step is the legitimate interest.
• Marketing: With your explicit consent, we may process your personal data to send you commercial communications and invite you to participate in our promotional initiatives, as well as subscribe to the newsletter. The legal basis for this processing is your consent, which can be revoked at any time.
• Profiling: With your explicit consent, we may process your personal data for profiling purposes, i.e., to analyze or predict your potential tastes, habits, and consumer choices in order to offer you personalized products, services, promotions, and commercial communications. The legal basis for this processing is your consent, which can be revoked at any time.
Outside of the aforementioned cases:
• Analytical purposes: The personal data provided by you during interaction with Ceramiche Bucci S.R.L. and the information related to such interaction will be collected in our database and used anonymously to analyze and improve the services offered, assess the effectiveness of activities and initiatives promoted by Ceramiche Bucci S.R.L., and conduct statistical analysis on the composition of the database itself. The legal basis for this processing is the legitimate interest of the data controller.
• Any other purpose for which you have expressly provided your consent, which can be revoked at any time.
6. NATURE OF DATA PROVISION
The provision of your personal data may be optional or mandatory depending on the pursued purpose. When the provision is mandatory, it means that failure to provide the requested personal data may prevent you from accessing certain services (for example, providing an address is necessary to place orders and make purchases, and failure to provide such information will not allow the completion of the order/purchase). When the provision is optional, you can still enjoy basic services but not additional services (for example, if you do not consent to receiving promotional communications, it will not affect the completion of an order/purchase but will result in the inability to stay updated on our promotions and initiatives).
The mandatory or optional nature of the provision will be indicated from time to time through the use of symbols (e.g., "*") next to the information for which provision is mandatory to achieve the respective purpose.
Your personal data is processed by the data controller, to the extent of their competence, for:
• Managing requests related to the exercise of rights concerning the protection of personal data (more information in point 6). This processing is necessary to comply with a legal obligation to which the data controller is subject.
• Other obligations regarding the protection of personal data. In certain circumstances, data protection regulations require the data controller to use your contact information to provide you with specific information about the processing of your data, such as notifying you of any security breaches involving your data and the measures taken to address them (so-called data breaches), as well as informing you of any relevant updates to this privacy notice. Therefore, this processing is necessary to comply with a legal obligation to which the data controller is subject.
7. DATA PROCESSING METHODS
Your personal data will be processed in compliance with the provisions of the current privacy regulations, both through the use of electronic and automated means, and through manual methods, with logic strictly related to the purposes of the processing. This will be done through the use of databases, electronic platforms managed by Ceramiche Bucci S.R.L. or third parties (appointed as data processors), integrated computer systems of Ceramiche Bucci S.R.L. and the aforementioned third parties, and/or websites owned or used by Ceramiche Bucci S.R.L.
Personal data is mainly processed at the premises of the data controller and at the locations where the data processors are located.
8. SHARING AND TRANSFER OF PERSONAL DATA
For the purposes stated above, your personal data may be accessible to employees and collaborators of CERAMICHE BUCCI S.R.L.
The personal data provided by you may be transferred to third-party companies located within the European Union (EU) and outside of it, as well as within the European Economic Area (EEA), responsible for carrying out the aforementioned personal data processing activities on behalf of the data controller, acting as data processors.
Transfers of personal data to third-party companies outside the EU/EEA are carried out in accordance with Chapter V of the GDPR. In particular, they are based on the Standard Contractual Clauses (SCC) approved by the European Commission. To obtain a copy of these SCC, please contact the data controller at the contact details indicated in point 12 of this notice.
Your data may also be transmitted to the judicial authority when necessary and in cases provided for by law.
9. DATA RETENTION PERIOD
In order to ensure compliance with the principles of necessity and proportionality of the processing, different data retention periods have been defined for each specific purpose pursued:
• For online product sales and related activities, your personal data will be retained for the entire duration of the contractual relationship and for 10 (ten) years following its termination, except for the registration on the Website - "Account" area and the use of services reserved for registered users (e.g., Wish List, My Orders, etc.), for which your personal data will be retained until you request the deletion of your account.
• Billing data will be retained for a period necessary to ensure the proper execution of the contract and, in any case, for an additional ten years for administrative and tax purposes.
• For profiling or personalized marketing purposes, your data will be retained for a period of 7 (seven) years from the moment you provided your consent for such purposes, following an assessment of the data protection impact conducted by Ceramiche Bucci with the participation of the Data Protection Officer.
• For generic marketing activities, your data will be retained by Ceramiche Bucci until you request deletion, revoke consent, or object to the processing. Ceramiche Bucci also wants to protect your data and ensure that you wish to continue receiving its communications. Therefore, your data will be deleted when 4 (four) years have elapsed since your last interaction with Ceramiche Bucci, for example, through purchases on the Website, participation in events, or interaction with Ceramiche Bucci's newsletter.
• To comply with legal obligations regarding the processing of personal data, your personal data will be processed by each data controller, to the extent of their competence, for the period necessary to handle your request to exercise the rights recognized by the GDPR or to comply with the legal obligations to which the data controller is subject. Data necessary to demonstrate compliance with legal obligations will be retained for 10 (ten) years.
• Data provided to Ceramiche Bucci S.R.L. will be retained for the period necessary to handle the requests and subsequently deleted in the absence of further contact, except for any administrative obligations (e.g., a complaint request must be retained beyond the management period for administrative purposes).
• In case you have not provided the aforementioned consents, your personal data will be anonymized and used for statistical analysis purposes.
• In the event of a judicial or administrative dispute, your data will be retained for the period necessary for the judicial protection of a right by Ceramiche Bucci or a third party, or within the limits imposed by the judicial or administrative authority.
10. DATA OF MINORS
Ceramiche Bucci S.R.L. does not intend to collect personal data of minors or establish deliberate communication with them. Therefore, we encourage parents to actively monitor the online activities of children under the age of sixteen.
However, in the event that we come into contact with a minor under the age of 16, we will request the consent of parents or legal guardians.
11. RIGHTS OF THE DATA SUBJECT
You may exercise at any time, with respect to the Data Controller, the rights recognized by the GDPR, including:
• The right to obtain confirmation as to whether or not personal data concerning you are being processed, and, if so, to access and obtain a copy of such personal data ("right of access").
• The right to rectify your personal data, that is, to obtain the correction, modification, or updating of any inaccurate or outdated data, as well as the integration of incomplete personal data, by providing a supplementary statement ("right of rectification").
• The right to withdraw your consent ("right to withdraw consent"): You may withdraw the consent you have given for the processing of your personal data at any time, including processing for marketing purposes, including profiling. Marketing activities include sending commercial and promotional communications, conducting market research and surveys to assess satisfaction, and personalizing commercial offers based on your interests. Upon receiving your request, the Data Controller will promptly cease processing your personal data based on such consent, while other processing activities based on different grounds will continue to be carried out in full compliance with applicable regulations.
• The right to request the erasure of your personal data when, in particular, (i) they are no longer necessary for the purposes for which they were collected or processed, or (ii) they have been unlawfully processed, or (iii) they must be erased to comply with a legal obligation, or finally, (iv) you have objected to their processing (see below "right to object") and there are no prevailing legitimate grounds for the Data Controller to proceed with the processing ("right to erasure" or "right to be forgotten").
• The right to restrict the processing of your personal data, meaning that the Data Controller will keep such data without being able to use them, except for any requests from you and the exceptions provided by law. This right can be exercised when, in particular, (i) you contest the accuracy of the personal data for a period allowing the Data Controller to verify the accuracy of such personal data, or (ii) the processing of data is unlawful and you request the restriction of their use instead of their erasure, or (iii) despite the Data Controller no longer needing them for processing purposes, the personal data are necessary for the establishment, exercise, or defense of a legal claim, or (iv) you have objected to their processing (see below "right to object"), pending verification as to whether the Data Controller's legitimate grounds override those of the data subject (right to restriction).
• The right to request your data or transfer them to a different data controller ("right to data portability"). You may request to receive the data processed based on your consent or on a contract concluded with you in a structured, commonly used, and machine-readable format. If technically feasible and upon your request, we may directly transfer your data to a third party indicated by you.
• The right to lodge a complaint with one of the competent supervisory authorities for the protection of personal data if you believe that the processing of your personal data has been carried out unlawfully ("right to lodge a complaint"). In Italy, the complaint can be submitted to the Garante per la Protezione dei Dati Personali (http://www.garanteprivacy.it/).
• Additionally, as the data subject, you also have the "right to object," which means you have the right to object at any time, for reasons relating to your particular situation, to the processing of your personal data carried out for the pursuit of the Data Controller's legitimate interest or for marketing purposes, including profiling. The Data Controller will refrain from further processing your personal data unless they demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or for the establishment, exercise, or defense of a legal claim.
In order to ensure full compliance with the aforementioned rights and to prevent violations or unauthorized access to our users' data by third parties, we may request some information from you to verify your identity or to seek clarification regarding the request made before accommodating it.
12. PROCEDURES FOR EXERCISING RIGHTS
If you wish to exercise the aforementioned rights or seek further clarification regarding the processing of your personal data, you may write to the following email address: email@example.com or to the address of the Data Controller's registered office located at:
Ceramche Bucci srl
Strada della Romagna, 143, 61121, Pesaro (PU).