Privacy Policy
1. Who is the Data Controller
The Data Controller is Arzilli S.R.L., with registered office at Viale Cesare Battisti, 24, 61121 Pesaro – VAT No. 02670210414, email address info@arzilli.sm (The “Controller”).
For the processing purposes described in paragraph 3.1 (Sale of goods and services, post-sale assistance, and fulfillment of your requests, as well as compliance with legal obligations), the Data Controller is Arzilli S.R.L., with registered office at Viale Cesare Battisti, 24, 61121 Pesaro – VAT No. 02670210414, email address info@arzilli.sm.
2. What Personal Data We Process
For the purposes indicated in this privacy notice, in compliance with your choices and your consent where required, the Data Controller will process the following personal data:
- Personal identification data: first name, last name, and date of birth;
- Contact details: address, phone number, and email;
- Data related to your purchases (date and place, number, type, and characteristics of the products purchased) and consumption preferences.
3. Purpose of Processing and Legal Basis
This paragraph 3 contains a description of the possible purposes of processing pursued by the Company, depending on the service you request.
- 1. Sale of goods and services, post-sale assistance, and fulfillment of your requests, as well as compliance with legal obligations
If you decide to purchase a product or service at any of the Company’s direct stores or through the Website, your personal data will be processed solely for the purpose of managing the sale and related obligations, and therefore to carry out all order management activities (including administrative management of the contract, product shipping, payment handling, credit management, any disputes, and fraud prevention), as well as those required by law.
If you request post-sale assistance for purchases made through the Website and/or at a direct store, or make any other request to the Company, you may contact Customer Service (go to the Contact page).
The personal data you provide will be processed exclusively to respond to your requests.
Providing your personal data for the purposes described above is mandatory. Consequently, any refusal to provide such data will make it impossible for the Company to fulfill your requests or to conclude the sales contract for its products/services.
For the purposes described in this paragraph 3.1, the Company does not require your specific consent.
Your personal data will be processed for the time necessary to conclude and manage the contract, as well as to handle any subsequent requests related to post-sale assistance. Afterwards, your personal data will be retained for 10 years from the conclusion of the contract, in accordance with the limitation period provided by applicable law.
- 2. Sending the Newsletter
By completing the dedicated section available on the Website’s homepage, you can subscribe to Arzilli S.R.L.’s newsletter to stay updated on the products and services offered. In this case, the newsletter will be sent to your email solely to fulfill your request to stay informed about Arzilli S.R.L.’s news and does not require your consent. In any case, upon receiving each newsletter, you can easily opt out of receiving further communications from Arzilli S.R.L.
Your personal data will be processed until you decide to unsubscribe from the newsletter by using the “unsubscribe” link provided in all our electronic commercial communications, or by contacting Arzilli S.R.L. at the email address indicated in paragraph 1 above.
- 3. Marketing Activities
If you wish to stay updated on the latest news regarding products and services offered by Arzilli S.R.L., you can opt in to our marketing initiatives, thereby allowing Arzilli S.R.L. to send you newsletters and/or informational, advertising, and/or promotional material, as well as invitations to commercial events.
Participation in Arzilli S.R.L.’s marketing initiatives is possible through the Website by providing some of your personal data, in particular your contact details (email, phone number, address). In this regard, we invite you to provide only the contact details through which you wish to be contacted.
To allow us to contact you by phone or at your address, you must provide your consent.
Sending communications to your email address does not require your consent, based on the legitimate interest of Arzilli S.R.L., provided that you can easily object to receiving further communications from Arzilli S.R.L. upon receipt of each email.
Participation in marketing initiatives remains optional, and your refusal will not affect the execution of any other activities you request (e.g., purchasing a product), but it will prevent Arzilli S.R.L. from keeping you updated on the latest news regarding the products and services offered.
Your contact details, necessary to send you updates on the products and services offered by Arzilli S.R.L., will be retained for a maximum period of 7 years from your last purchase, and at the end of this period, such data will be automatically deleted or permanently anonymized.
Right to Object to Direct Marketing Activities
We inform you that you have the right to object to direct marketing activities at any time by contacting Arzilli S.R.L. at the email address indicated in paragraph 1 of this Privacy Notice. In any case, upon receiving each email communication, you can easily opt out of receiving further communications from Arzilli S.R.L.
- 4. Profiling Activities
Arzilli S.R.L. may also analyze your consumption habits and choices in order to send you personalized marketing communications. To allow Arzilli S.R.L. to carry out profiling activities, your explicit consent is required, which can be given through the Website.
Acceptance of profiling activities is optional, and your refusal will not affect the execution of any other activities you request (e.g., purchasing a product or receiving the newsletter).
Your personal data will be retained for a maximum period of 7 years, and at the end of this period, such data will be automatically deleted or permanently anonymized.
Right to Object to Profiling
We inform you that you have the right to object to profiling at any time by contacting Arzilli S.R.L. at the email address indicated in paragraph 1 of this Privacy Notice.
4. How Your Personal Data Will Be Processed
The processing of your personal data will be carried out, in compliance with the provisions of the GDPR, using paper, computer, and telematic tools, following procedures strictly related to the purposes indicated and, in any case, in a manner suitable to ensure their security and confidentiality in accordance with the provisions of Article 32 of the GDPR.
5. To Whom Your Personal Data May Be Disclosed and Who May Have Access
For the purposes described in the previous paragraph 3, your personal data will be accessible to the Controller’s employees, equivalent personnel, and collaborators, who will act as individuals specifically authorized to process personal data.
In addition, your personal data will be processed by third parties, belonging, by way of example, to the following categories:
- a) parties engaged by the Company to provide the requested services;
- b) authorities and supervisory or regulatory bodies, and, more generally, public or private entities with official functions;
- c) parties who handle administrative and tax obligations on behalf of the Company;
- d) other subsidiaries or affiliated companies;
- e) parties providing services for the management of Arzilli S.R.L.’s IT systems and telecommunications networks;
- f) parties carrying out control, auditing, and certification activities related to the Company’s operations.
The parties belonging to the categories listed above operate, in some cases, fully independently as separate Data Controllers, and in other cases as Data Processors specifically appointed by the Controller in accordance with Article 28 of the GDPR.
The complete and up-to-date list of parties to whom your personal data may be disclosed can be requested at the Controller’s registered office.
The personal data processed by the Controller are not disclosed publicly.
The processing activities described in this privacy notice do not involve the transfer of your personal data outside the European Union.
In any case, the Controller guarantees that, should any transfers occur, they will be carried out in compliance with the standard data protection clauses adopted by the Commission, in accordance with Article 46 of the GDPR, ensuring protection equivalent to that provided under the GDPR.
6. Your Rights as a Data Subject
In relation to the processing described in this Privacy Notice, as a data subject, you may, under the conditions set out in the GDPR, exercise the rights provided by Articles 15 to 21 of the GDPR, and in particular, the following rights:
- Right of access – Article 15 GDPR: the right to obtain confirmation as to whether or not personal data concerning you are being processed and, if so, to access your personal data – including a copy of them – and to receive, among other things, the following information:
- a) purposes of the processing
- b) categories of personal data processed
- c) recipients to whom the data have been or will be disclosed
- d) data retention period or the criteria used to determine it
- e) the data subject’s rights (rectification, erasure of personal data, restriction of processing, and the right to object to processing)
- f) the right to lodge a complaint
- g) the right to receive information about the source of my personal data if they were not collected from the data subject
- h) the existence of automated decision-making, including profiling;
- Right to rectification – Article 16 GDPR: the right to obtain, without undue delay, the correction of inaccurate personal data concerning you and/or the completion of incomplete personal data;
- Right to erasure (right to be forgotten) – Article 17 GDPR: the right to obtain, without undue delay, the deletion of personal data concerning you, when:
- a) the data are no longer necessary for the purposes for which they were collected or otherwise processed;
- b) you have withdrawn your consent and there is no other legal basis for the processing;
- c) you have successfully objected to the processing of your personal data;
- d) the data have been processed unlawfully;
- e) the data must be erased to comply with a legal obligation;
- f) the personal data were collected in relation to the offer of information society services referred to in Article 8(1) GDPR.
The right to erasure does not apply to the extent that processing is necessary for compliance with a legal obligation, for the performance of a task carried out in the public interest, or for the establishment, exercise, or defense of a legal claim.
- Right to restriction of processing – Article 18 GDPR: the right to obtain restriction of processing when:
- a) the data subject contests the accuracy of the personal data;
- b) the processing is unlawful and the data subject opposes the erasure of personal data, requesting instead that its use be restricted;
- c) the personal data are necessary for the data subject for the establishment, exercise, or defense of a legal claim;
- d) the data subject has objected to the processing pursuant to Article 21(1), pending verification as to whether the legitimate grounds of the Controller override those of the data subject.
- Right to data portability – Article 20 GDPR: the right to receive the personal data concerning you, which you have provided to the Data Controller, in a structured, commonly used, and machine-readable format and the right to transmit that data to another controller without hindrance, if the processing is based on consent and is carried out by automated means. Furthermore, the right to have your personal data transmitted directly from the Data Controller to another controller, where technically feasible;
- Right to object – Article 21 GDPR: the right to object, at any time, to the processing of your personal data based on legitimate interest, including profiling, unless there are compelling legitimate grounds for the Data Controller to continue processing that override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims.
Furthermore, the right to object at any time to processing if personal data is processed for direct marketing purposes, including profiling, to the extent that it is related to such direct marketing.
- lodge a complaint with the Italian Data Protection Authority, Piazza di Montecitorio n. 121, 00186, Rome (RM).
The above rights may be exercised by contacting the Data Controller at the addresses indicated in paragraph 1.
The Data Controller will process your request and provide you, without undue delay and, in any case, no later than one month after receiving it, with information relating to the action taken regarding your request.
The exercise of your rights as a data subject is free of charge pursuant to Article 12 of the GDPR. However, in the case of manifestly unfounded or excessive requests, including due to their repetitive nature, the Data Controller may charge you a reasonable fee, taking into account the administrative costs incurred in handling your request, or refuse to comply with your request.
Finally, we inform you that the Data Controller may request further information necessary to confirm the identity of the interested party.
