In compliance with the obligations arising from national legislation (Legislative Decree No 196 of 30 June 2003, Protection of Personal Data Act) and EU legislation (European Regulation for the Protection of Personal Data No. 679/2016, GDPR) and subsequent amendments, this site respects and protects the confidentiality of visitors and users, making every possible and proportionate effort not to infringe the rights of users.
The data controller is GFL SA, with registered office in Via Sorengo 1, 6900 Lugano (Switzerland), which will process your data in accordance with GDPR 679/2016.
Data Controller's e-mail address: firstname.lastname@example.org
Legal basis for processing
The provision of data and therefore Consent to the collection and processing of data is optional, the User may refuse consent, and may revoke a consent already provided at any time (via e-mail: email@example.com or by clicking on unsubscribe). However, refusing consent may result in the inability to provide certain services and the experience of navigating the site may be compromised.
Where provided, the personal data of customers who are natural persons or natural persons who operate in the name and on behalf of customers who are legal persons, are processed by the Data Controller:
Data collected and purposes
a. administrative and accounting purposes: performance of the online sales contract, accounting and compliance with legal obligations, after-sales services.
b. only with your consent, for marketing purposes: that is, to send advertising or commercial communication material by contact methods such as e-mail. The Data collected for this purpose will be kept until your consent is revoked.
For the purposes of point a. the Data Controller may collect and process the following Personal Data:
• personal data: name, second name, surname, first name and surname in local alphabet;
• contact details: telephone/mobile phone number; email address;
• data concerning purchases made on the online store: shipping and billing address, delivery and payment method, name of credit card holder and credit card expiry date.
In addition to the aforementioned Personal Data, for the purposes referred to in point b., the Data Controller may also collect and process the following Personal Data relating to your profile:
• data on purchases made on the online store: detail of the products purchased, price, discount, number of pieces, colour, model, collection, level of expense calculated, abandoned cart;
• information on participation in prize-giving events;
The provision of data is mandatory in accordance with legal requirements, regulatory regulations and is a condition for the proper and effective fulfilment of the contractual obligations.The provision of further personal data may be necessary to improve the quality and efficiency of the transaction (purposes point b).
Refusal to provide data
Therefore, refusal to provide further data may wholly or partly compromise the processing of other requests and the quality and efficiency of the transaction itself.
In particular, refusal to consent to the processing of data for the purposes referred to in point b will prevent the provision of the above services, but will not compromise the fulfilment of the contractual obligations.You may revoke your consent to the purposes referred to in point b. at any time by contacting the Data Controllers directly at the above addresses. Failure to provide Personal Data and/or to grant consent will preclude the pursuit of the purposes described in point b but will have no consequences on your ability to complete any purchase of interest to you.
The Data Controller keeps and processes personal data using computerised and paper instruments for the time necessary to fulfil the purposes indicated. Subsequently, the personal data will be stored, but no longer processed, for the time established by the civil and fiscal provisions in force.
The personal data processed by the Data Controller will not be disclosed, or will not be transmitted to undetermined subjects, in any possible form, including that of their provision or simple consultation. They may, however, be disclosed to workers employed by the Data Controller and to certain third parties who work with them. They may also be disclosed, as far as is strictly necessary, to persons who, for the purposes of processing orders or other requests or providing services relating to the transaction or contractual relationship with the Data Controller, must supply goods and/or perform services or services on behalf of the Data Controller. Finally, they may be disclosed to persons entitled to access them by virtue of the provisions of law, regulations and EU regulations.
Recipients of the data
In particular, your data will be processed:
• by internal subjects such as the employees of the company or collaborators with other contractual forms under the direct control of the Data Controller;
• by third parties to perform specific activities related to particular professional figures and/or techniques, involving the processing of data. These persons are appointed as external data processors and are therefore subject to the obligations imposed on them by current legislation. Among the external data processors, for example, GFL AG refers to
- banks, entities or other parties to whom the transfer of the above data is necessary for managing transactions and performing activities on our behalf in relation to our fulfilment of the agreements entered into with the customer;
- public bodies and institutions including the Inland Revenue, INPS, INAIL (national insurance and social security bodies, CCIAA (chambers of commerce), Region, Province, Municipalities;
- Debt collection companies;
- Law firms;
- Professional firms;
- Couriers and shipping companies;
- Tax consultancy firms (accountants, tax consultants, etc.).
With reference to Articles 15 to 22 of GDPR 679/16, the person concerned may at any time:
Rights of the data subject
• ask for confirmation of the existence or otherwise of their personal data;
• obtain information on the purposes of the processing, the categories of personal data, the recipients or categories of recipients to whom the personal data have been or will be disclosed and, where possible, the retention period;
• obtain the rectification and erasure of data;
• obtain the restriction of the processing;
• obtain the portability of data, i.e. receive them from a data controller, in a structured, commonly used and machine-readable format, and to transmit those data to another controller without hindrance;
• object to the processing at any time and also in the case of processing for direct marketing purposes;
• object to any automated decision process concerning physical persons, including profiling.
• request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability;
• withdraw consent at any time without prejudice to the lawfulness of the processing based on consent given prior to the withdrawal;
• lodge a complaint with a supervisory authority.
The party concerned may exercise his/her rights by writing to the Data Controller at the above addresses, or by e-mail to the following electronic address firstname.lastname@example.org, specifying the subject of his/her request, the right he/she intends to exercise and attaching a photocopy of an identity document attesting to the legitimacy of the request.