1. Data Controller
CADORE ARREDAMENTI S.R.L. (Tax Code: 02284160260), with registered office in Via Castellana, 4/1 – 31030 San Vito di Altivole (TV), Italy, acting as Data Controller (hereinafter the “Controller”), provides this privacy notice pursuant to Articles 13 and 14 of EU Regulation 2016/679 (hereinafter “GDPR”).
2. Data Collected, Purposes of Processing, Consequences of Non-Provision, and Nature of Provision
| Purpose | Data Processed | Legal Basis | Nature of Provision | Retention Period |
|---|---|---|---|---|
| A. Management of customer relations, contracts, and related procedures | Individual customers: personal identification, contact, and residential data.
Collaborators/employees of corporate customers: contact data. In addition to identification, contact, and banking data of corporate customers. |
– Performance of a contract to which the data subject is party or implementation of pre-contractual measures taken at the request of the data subject.
– Compliance with a legal obligation to which the data controller is subject. |
Mandatory: provision is necessary to manage relationships/contracts with suppliers/customers. |
Without prejudice to legal obligations, personal data will be processed for the period necessary to achieve the purposes for which they were collected, in any case for the entire duration of the contract/relationship/contact with the data subject and no longer than 10 years after its termination.
However, the Controller may continue to retain the data for a longer period in order to handle any potential disputes relating to the relationship established. |
| B. Management of purchases of goods and services and related procedures; management of supplier relations |
– Collaborators/employees of suppliers: identification data, contact data, and special categories of data in order to comply with obligations under Legislative Decree 81/2008. In addition to identification, contact, and banking data of corporate suppliers.
– Individual suppliers: personal identification, contact, and residential data, and special categories of data in order to comply with obligations under Legislative Decree 81/2008. |
|||
| C. Management of corporate accounting | Customers, suppliers: identification data, bank details. | |||
| D. Sending commercial communications | Customers: contact data. | For individuals who are already customers, the company may send commercial communications — exclusively via email — without the need to obtain prior consent, pursuant to Article 130, paragraph 4 of the Privacy Code. It will always be possible to opt out. | Optional | Until the data subject opts out. |
| E. Contact form on the website | Website users: contact and identification data. | Performance of a contract / Pre-contractual measures. | Optional | For the time necessary to handle the request of the data subject. |
| F. Cookies and website tracking tools | Website users: IP address or other data collected by activated cookies. | Explicit consent. | Optional | Please refer to the cookie policy available on the website for more information. |
3. Processing Methods
The collected data are processed using paper and electronic tools.
The Controller processes Users’ Personal Data in compliance with Legislative Decree 196/2003 and the GDPR, adopting appropriate security measures to prevent unauthorized access, disclosure, modification, or destruction of Personal Data.
The collected data (limited to personal data) may be communicated to non-EU countries for the purposes stated above: in such cases, the Data Controller undertakes to ensure adequate levels of protection and safeguards in accordance with applicable laws.
4. Parties Involved in Processing
The collected data are processed by persons designated as data processors or authorized personnel, as provided for by Articles 29 and 30 of Legislative Decree 196/2003 and Articles 28 and 29 of the GDPR.
The collected data may be processed, exclusively for the indicated purposes, by the Controller’s personnel or by third parties, such as:
- Companies providing IT system maintenance services;
- Associations, consultants, professional firms, and companies providing assistance and consultancy to the Controller;
- Customers and/or suppliers with whom the data subject interacts in the performance of their duties (limited to non-sensitive personal data);
- Social security, assistance, and insurance institutions, tax administration, and other public bodies or authorities where authorized by law, regulation, or contract.
5. Rights of the Data Subject
You may exercise your rights as set out in Articles 15 to 21 of the GDPR, and specifically:
- Obtain access to personal data, request their rectification or erasure, or restriction of processing concerning you, or object to their processing, as well as the right to data portability;
- Withdraw consent at any time, where processing is based on Article 6(1)(a), without affecting the lawfulness of processing based on consent before its withdrawal;
- Lodge a complaint with a supervisory authority.