EXTENDED INFORMATION PURSUANT TO ARTICLES 12, 13, AND, IF APPLICABLE, 14 OF THE GDPR – REGULATION (EU) 2016/679 ON THE PROTECTION OF NATURAL PERSONS WITH REGARD TO THE PROCESSING OF PERSONAL DATA (HEREINAFTER THE GDPR)

The data controller hereby provides, below, the Information pursuant to articles 12, 13, and, if applicable, 14 of the GDPR concerning the processing of personal data provided by the Customer/interested party through the completion and signing of the Contract to purchase products/services offered for sale by the data controller, spontaneously uploading personal data on this website (in particular through the completion of forms) or simply browsing it.

1. Data controller and contact details

The data controller is Gea Luce s.r.l., located in San Severo (FG) ZIP 71016, Via Tardio, s.n., VAT number 01913370712, tel. 0882 374954, email info@gealuce.com, website www.gealuce.com (hereinafter the Site).

2. Principles applicable to processing

In accordance with the GDPR, the data controller constantly ensures that personal data are:

(a) processed lawfully, fairly, and transparently;

(b) collected for specified, explicit, and legitimate purposes and subsequently processed in a manner that is not incompatible with those purposes;

(c) adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed;

(d) accurate and, if necessary, kept up to date;

(e) kept for no longer than is necessary for the purposes for which they are processed;

(f) processed using appropriate technical and organizational measures to ensure security;

(g) processed, if based on consent, by a decision freely made by the Customer/interested party, based on a request presented in a clearly distinguishable form, in a comprehensible and easily accessible form, using clear and simple language.

The data controller adopts technical and organizational measures to ensure the protection of personal data from the design stage and to ensure that only the necessary data for each specific processing purpose are processed by default.

The data controller collects and gives maximum consideration to indications, observations, and opinions of the Customer/interested party transmitted to the contact details provided above, in order to implement a dynamic privacy management system that ensures effective protection of individuals regarding the processing of their data.

This Information may undergo changes, in coherence with the evolution of the reference legislation and the technical and organizational measures adopted over time by the data controller; the Customer/interested party is, therefore, requested to periodically visit this section of the Site to view updates and the Information in the text currently in force.

3. Methods of processing personal data

The processing of personal data is carried out manually and with electronic tools, with logic strictly related to the purposes indicated below and, in any case, in such a way as to ensure the security and confidentiality of the data.

4. Purposes of processing personal data

(4a) Purposes for which data processing is necessary

The personal data provided by the Customer/interested party are mainly processed for the execution of the Contract and credit management, and, more generally, the relationship arising from the Contract itself.

The provision of data in the Contract or subsequently, during the contractual relationship, for the processing purposes in question is mandatory; therefore, the failure, partial, or inaccurate provision of such data makes it impossible to conclude and/or execute the Contract and, for the Customer/interested party, to enjoy the products/services offered by the data controller, potentially exposing the Customer/interested party to liability for breach of contract.

The personal data provided by the Customer/interested party may also be processed if necessary to comply with a legal obligation to which the data controller is subject, to safeguard the vital interests of the Customer/interested party or another natural person, for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller, or for the pursuit of the legitimate interests of the data controller or third parties, provided that the interests or fundamental rights and freedoms of the Customer/interested party do not prevail; even in these cases, the provision of data is mandatory, and therefore, the failure, partial, or inaccurate communication of data may expose the Customer/interested party to possible liabilities and penalties provided for by the legal system.

(4b) Additional purposes of processing following specific and express consent of the Customer/interested party

In addition to the processing purposes mentioned above, personal data provided/acquired may be processed, subject to the consent of the Customer/interested party, to be expressed by selecting the « Consent » box on the Contract or on the Site (or using other social or web applications of the data controller), also for conducting market research and for carrying out commercial and promotional communications, via telephone (also using the provided mobile number) and automated contact systems (email, SMS, MMS, fax, etc.), about products/services of the data controller or companies of the Group to which the data controller may belong.

Consent for the processing purposes under this point (4b) is optional; therefore, following any refusal, the data will be processed only for the purposes indicated in the previous point (4a), except as specified below regarding the legitimate interests of the data controller or third parties.

 

5. Categories of personal data processed

The data controller mainly processes identifying/contact data (name, surname, addresses, type and number of identification documents, telephone numbers, email addresses, tax/invoicing information, among others) and, where commercial transactions are involved, financial data (banking information, in particular current account identifiers, credit card numbers, among others related to the aforementioned commercial transactions).

The processing carried out by the data controller, both for the execution of the Contract and based on the explicit consent of the Customer/interested party, generally does not concern special categories of personal data, known as sensitive (revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, health status, or sexual orientation, etc.), nor genetic and biometric data, or so-called judicial data (relating to criminal convictions and offenses).

However, it cannot be excluded that, in order to fulfill the obligations arising from the Contract, the data controller may need to retain and/or process sensitive, genetic, and biometric, or judicial data of the Customer/interested party or third parties, of which the Customer/interested party acts as data controller; in this case, the processing by the data controller takes place under the conditions and within the limits specified in the appointment of the same data controller as data processor, by the Customer/interested party.

The data controller processes, as data controller with reference to the Site, and potentially, as data processor appointed by the Customer/interested party, also the so-called navigation data. The computer systems and software procedures used to operate websites acquire, during their normal operation, some personal data, the transmission of which is implicit in the use of internet communication protocols. These are information that are not collected to be associated with identified individuals but, by their very nature, could allow users to be identified. This category of information includes geolocation data, IP addresses, type of browser, operating system, domain name, and website addresses from which access or exit was made, information about pages visited by users within the site, access time, time spent on each page, internal path analysis, and other parameters relating to the user’s operating system and computer environment. These are therefore information that, by their very nature, allow, through processing and association with data held by third parties (such as internet providers), the identification of users. These data are used for the sole purpose of obtaining anonymous statistical information on the use of the Site and to check its correct functioning and are deleted immediately after processing. The data could be used to ascertain responsibility in the event of hypothetical computer crimes against the Site or third parties; except for this eventuality, the data on web contacts are currently not kept for more than seven days.

The data controller uses so-called technical cookies on the Site to guarantee the functionality and use of the same and so-called third-party analytical cookies to acquire aggregate statistical information on the navigation of users who access the Site, with a view to improving the operation and use of the Site itself; this without collecting information that allows users to be personally identified.

6. Legal basis for processing

The legal bases for the processing of personal data by the data controller for the purposes referred to in point (4a) above are as follows:

• fulfillment of contractual obligations (Article 6(1)(b) of the GDPR);
• fulfillment of legal obligations (Article 6(1)(c) of the GDPR);
• safeguarding the vital interests of the Customer/interested party or another natural person (Article 6(1)(d) of the GDPR);
• performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller (Article 6(1)(e) of the GDPR);
• pursuit of the legitimate interests of the data controller or third parties (Article 6(1)(f) of the GDPR).

The legal basis for processing personal data by the data controller for the purposes referred to in point (4b) above is the explicit consent given by the Customer/interested party (Article 6(1)(a) of the GDPR).

7. Recipients or categories of recipients of personal data

The personal data provided may be communicated by the data controller to authorized persons, identified from time to time, within the company organization, or to third parties, public or private, to whom communication is necessary for the proper fulfillment of contractual obligations, obligations imposed by law, or for the pursuit of the legitimate interests of the data controller or third parties.

In particular, for the execution of the Contract, the data may be communicated to the following categories of subjects:

• employees and collaborators of the data controller, appointed as authorized data processors and persons in charge of processing, who have received appropriate instructions on the processing of personal data, including security measures, to comply with the relevant provisions of the GDPR;

• companies of the Group to which the data controller may belong, including any subsidiaries and/or affiliates, also located in non-EU countries (including outside the European Economic Area), appointed as authorized data processors or persons in charge of processing, for the purposes indicated above, always in compliance with the relevant provisions of the GDPR, including the adoption of appropriate safeguards provided for by Chapter V of the GDPR (in particular, standard contractual clauses or binding corporate rules, or adequacy decisions concerning the country of destination);

• suppliers of goods and/or services, banks and credit institutions, financial intermediaries, and insurance companies, for the management of commercial transactions, including payment management, for the performance of services ancillary to the Contract, and, more generally, for the execution of the Contract and the related obligations;

• consultants and freelancers, law firms, consultants, notaries, accountants, and other professionals, also appointed as authorized data processors or persons in charge of processing, for the protection of contractual rights, also in the context of any legal disputes, including any debt collection procedures;

• subjects (public or private), natural or legal persons, to whom communication is necessary for the fulfillment of legal obligations to which the data controller is subject or for the pursuit of legitimate interests, also in the context of potential extraordinary transactions (such as mergers, acquisitions, divestments, etc.).

The data controller may also communicate personal data to public authorities, regulatory bodies, judicial authorities, or other subjects to whom communication is required by law or by the request of competent authorities, or necessary to safeguard the rights and interests of the data controller or third parties.

8. Data transfer to a third country or to international organizations

The data controller, in its capacity as data controller, does not intend to transfer personal data to third countries or to international organizations outside the European Economic Area (EEA), including by storing them on servers located in non-EU countries; in any case, if necessary for the execution of the Contract or for the pursuit of the legitimate interests of the data controller or third parties, the transfer will take place in compliance with the provisions of Chapter V of the GDPR, including the adoption of appropriate safeguards, provided for by the GDPR.

The Customer/interested party may request further information from the data controller regarding the possible existence of adequate guarantees pursuant to Articles 46 or 47 or Article 49(1)(2) of the GDPR, as well as obtain a copy or the place where they were made available.

9. Retention period of personal data

The personal data provided will be processed and stored by the data controller for the time strictly necessary to achieve the purposes for which they were collected, in accordance with the principles of necessity, proportionality, and minimization referred to in Article 5(1)(c) of the GDPR.

In particular, with reference to the purposes referred to in point (4a) above, personal data will be kept for the duration of the Contract and, subsequently, until the expiry of the terms provided for by law for the exercise of rights and the fulfillment of contractual obligations or for the management of any disputes, including debt collection procedures; with reference to the purposes referred to in point (4b) above, personal data will be kept until revocation of consent by the Customer/interested party, who may exercise it at any time, without prejudice to the processing carried out before the revocation.

Upon expiry of the storage periods indicated above, personal data will be destroyed or permanently anonymized by the data controller, in compliance with the relevant provisions of the GDPR.

10. Rights of the data subject

The data subject, as defined in Article 4(1) of the GDPR, has the right to obtain from the data controller, in the cases and under the conditions provided for by Articles 15 to 22 of the GDPR, access to personal data and the rectification or erasure of the same or the restriction of processing concerning him/her or to object to processing, as well as the right to data portability, without prejudice to the possibility of revoking consent at any time without prejudice to the lawfulness of the processing based on consent given before the revocation.

The data subject also has the right to lodge a complaint with the supervisory authority responsible for the protection of personal data, in the manner and within the time limits established by the applicable legislation.

The data subject may exercise his/her rights by contacting the data controller at the contact details provided in point 1 above, also using the appropriate form available on the Site.

11. Automated decision-making processes

The data controller does not adopt automated decision-making processes, including profiling, referred to in Article 22(1) and (4) of the GDPR, which produce legal effects concerning the data subject or similarly significantly affect him/her.

12. Consequences of failure to provide data and automated decision-making processes

The provision of personal data by the Customer/interested party is mandatory for the purposes referred to in point (4a) above, for the conclusion and execution of the Contract and the related obligations and for the fulfillment of legal obligations by the data controller.

Any failure to provide personal data by the Customer/interested party for these purposes will make it impossible for the data controller to conclude or execute the Contract and fulfill the related obligations.

The provision of personal data by the Customer/interested party for the purposes referred to in point (4b) above is optional and does not affect the conclusion or execution of the Contract or the fulfillment of legal obligations by the data controller.

No automated decision-making processes are carried out by the data controller, including profiling, which produce legal effects concerning the data subject or similarly significantly affect him/her.

13. Amendments and updates

The data controller reserves the right to modify or simply update, in whole or in part, this Privacy Policy, also in consideration of changes in the applicable legislation or regulations governing the matter.

The data subject will be informed of any changes or updates made to this Privacy Policy, which will be binding from the moment of publication on the Site.

14. Texts applicable in case of disputes

In the event of disputes or discrepancies between the various translations of this Privacy Policy, the Italian text shall prevail, being the original version, to which the data subject expressly adheres.

This Privacy Policy is drawn up in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter, « GDPR ») and subsequent amendments and additions.

Date of last revision: January 2024.

Privacy Policy Version 1.0