The type of data processed
The company collects the data you contribute (the "Data>"), as detailed below, including:
a) identification and contact data contributed when an account is created on the Website;
b) data relating to purchases made through the Website;
d) data contributed when requesting information and assistance;
e) data contributed in order to take part in competitions, online surveys and/or promotional offers run through the Website.
Health data, and special categories of personal data in general as defined by article 9 of the European Data Protection Regulation, are not processed.
Children's data will be processed in accordance with point 8 below.
Data processing procedures
Your personal data are processed with the aid of digital and/or paper media and are protected by means of appropriate security measures which guarantee the confidentiality and security of the personal data. In particular, the Company adopts organisational and technical measures which protect the personal data it holds against loss, theft or the unauthorised disclosure or modification of the personal data.
Positive Studio anonymises personal data and removes identifying data when it is not necessary to process the personal data in identifiable form for the processing purposes, and at the end of the storage time specified in point 10 below.
How your data are processed
Positive Studio processes Data to:
1. enable you to register on the Website by creating a personal account, and to perform all the activities governed by the Website's Conditions of Sale, including purchases on the Website, and to use the services made available on the Website, including the customer care services, and to exercise and protect its own rights in relation to users and third parties ("Contract Purposes");
2. comply with any obligations imposed by laws and regulations (hereinafter "Legal Purposes");
3. undertake activities related to the sale of companies or company divisions, acquisitions, mergers, or other transformations, and implement these operations ("Legitimate Business Interest Purposes").
Positive Studio processes Data, with your prior consent, to:
a. send marketing communications by digital means (e.g. via email, sms, mms, ordinary mail, cell phone, social networks and applications) or paper means, with regard to its brands, services and/or products, for participation in events and to perform market and statistical analyses ("Marketing Purposes")
b. analyse habits, interests and preferences in order to target the marketing activities referred to above more effectively to your requirements ("Profiling Purposes").
Moreover, data relating to the amount spent, product category, shop where the purchase was made and date of birth may be used with effect from 25 May 2018 on the basis of the legitimate interest of Orciani Spa in the provision of a service more precisely tailored to the needs of data subjects, appropriately balanced with the need to safeguard data subjects' rights ("Legitimate Marketing Interest").
Legal basis of processing
The processing of personal data for Contract Purposes is compulsory, since it is necessary for registration, performance of the activities detailed in the Website's Conditions of Sale, the online purchase of products and the use of specific services offered via the Website. The provision of personal data for Legal Purposes is compulsory because it is required by the relevant legislation. If you do not wish your personal data to be processed for these purposes, you will be unable to use the Website and the services made available through it.
Processing for Purposes of Legitimate Business Interest is undertaken pursuant to article 24, comma 1 (d) of the Data Protection Code and in order to pursue the legitimate interest of Positive Studio and its counterparties in the conduct of the economic transactions indicated therein, pursuant to article 6 (f) of the Data Protection Regulation, suitably balanced with the interests of users, since processing takes place within the limits strictly necessary for the conduct of these operations.
The processing of personal data for Marketing and Profiling Purposes is optional and subject to your prior consent. If you fail to give your consent, Positive Studio will be unable to keep you up to date with new products or services, promotions or customised special offers, or to perform market surveys or send communications or other informative material which might meet with your interest.
Processing for Legitimate Marketing Purposes pursues a legitimate interest of Positive Studio suitably balanced with the interests of the data subjects in the light of the restrictions placed on the said processing in point 4), and will be undertaken with effect from 25 May 2018, the date when the Data Protection Regulation came into force.
Disclosure and communication of data
The Company signs contracts with selected third parties which supply services for the maintenance of the Website, customer communications management and other services. The services supplied by third parties are Website hosting, anti-fraud security, payment processing, shipping and delivery, correspondence and web marketing. The Data collected via the Website may be consulted by the said third parties only on the Company's behalf. In all cases, by law, the said service providers are not permitted to utilise the user's personal data for other purposes. The Company may also disclose the Data to banks or other third parties in relation to the payment transactions performed. Otherwise, the user's Data are not disclosed to other third parties, unless required by law, in relation to a law suit or legal proceedings, or when otherwise necessary to safeguard the Company's rights or interests.
Transfer of data abroad
Data may be freely transferred outside the country to European Union member states, but could also be transferred to Positive Studio Group companies located outside the European Union. Any transfer of your data to countries located outside the European Union will, in all cases, take place in accordance with the appropriate, suitable guarantees with regard to the transfer, pursuant to the relevant legislation and especially article 44 of the Data Protection Code and articles 45 and 46 of the Privacy Regulation.
Children less tham 18 years of age
You may, at any time and free of charge (a) obtain confirmation as to whether or not data relating to you exist, and disclosure of such data; (b) learn the origin of the data, the purposes of the processing and the methods used, and the logic applied in the case of electronic processing of the data; (c) request the updating, rectification or, if this is in your interest, the supplementation of the data; (d) obtain the erasure, conversion into anonymous form or blocking of data held in breach of the law, and object to the processing on legitimate grounds; (e) object, partially or entirely, to the processing of your data for direct marketing purposes, using automated and/or traditional methods; (f) withdraw consent to the processing of the data at any moment, without prejudice to the lawfulness of the processing based on the consent given prior to the withdrawal.
You may exercise your above rights, change the contact procedures, notify the Company of any updates to your data, request the erasure of your personal data disclosed by third parties, or obtain additional information with regard to their use by the Company, by contacting the latter at: email@example.com.
Provisions in force from 25 May 2018
The following provisions will come into force from 25 May 2018, further to the introduction of the Data Protection Regulation.
a) Term for the storage of personal data: the Company will process personal data for the time necessary to fulfil the purposes for which they were collected pursuant to point 2 above. In all cases, the following storage periods apply to the processing of personal data for the purposes listed below:
• idata collected for the Contract Purposes referred to in point 4 (1) are stored throughout the duration of the contract and for 10 years subsequent to its expiry for the protection and/or the judicial and/or extrajudicial exercise of a right of Positive Studio in the event of disputes related to the fulfilment of the contract;
• data collected for the Legal Purposes referred to in point 4 (2) are stored for a period equal to the duration specified for each type of data by law;
• data collected for Positive Studio Marketing Purposes, for Profiling Purposes and for Legitimate Marketing Interests as per point 4 are stored for a period of 7 years from the date of the last contact with you (e.g. your last purchase, last newsletter opened, etc.);
• data collected for the Business Purposes referred to in point 4 (3) are stored for a period of 10 years after collection.
After the above terms, your data may be erased, anonymised and/or aggregated.
b) Additional rights: Using the procedure specified in point 9 above, at any time you may: (a) request the restriction of the processing of the personal data in the event that (1) you contest the accuracy of the personal data, for the period necessary for verification of the accuracy of the personal data (2) the processing is unlawful and you object to the erasure of the personal data and instead request the restriction of their use; (3) the Company no longer needs the personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims; (iv) you have objected to processing pursuant to art. 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject; (b) to object to the processing of the personal data at any time; (c) to request the erasure of your personal data without undue delay; (d) to obtain the portability of your personal data; (e) to lodge a claim with the Supervisory Authority where the necessary conditions are met.
c) The Company has appointed a Data Protection Officer, who can be contacted at the following address: Commerciale@buranalab.com
Amendments and updates
If you have any doubts, remarks or complaints concerning the way in which your personal data are collected or processed, please contact the company using the Contacts section of the Website.