Termini & condizioni – Informativa Privacy
§ IN GENERAL
The internet sites www.amdl.it; www.micheledelucchi.it; www.produzioneprivata.com are owned by “architetto Michele De Lucchi s.r.l. – aMDL s.r.l.” (VAT 09029600153), in the person of the pro tem legal representative; the said company uses the site www.produzioneprivata.com (also accessed from www.aMDL.it), for the online sale of products under the brand name “Produzione Privata”, as illustrated in the catalogues on the said site.
Instead, www.micheledelucchi.it is only a “portal”, from which access can, in addition to the above-mentioned sites owned by the company aMDL s.r.l. and www.produzioneprivata.it, also be gained to www.micheledelucchiartworks.it, which is the property of Mr Michele De Lucchi personally (VAT 02191700125).
All browsing by users of the aforementioned sites and of all the activities which users may pursue (such as, to mention merely by way of example: subscription to the newsletter, online commercial transactions, etc….) shall be subject to EU Regulation 2016/679, 27 April 2016, relating to the protection of natural persons with regard to the personal data handling, as well as to the free circulation of any such data, which regulation came into effect on 25 May 2018, as well as to the D.Igs (legislative decree: Order of Council) no. 196, 30 June 2003 (“Code pertaining to the protection of personal data”), the latter meaning to the extent to which it is compatible with EU regulations.
The processing of personal data communicated by visitors to aMDL s.r.l. through these internet sites shall be based on the principles of honesty, lawfulness and transparency, protection of privacy and of the rights of every user, and on the other principles set forth under art. 5 of EU Regulation 2016/679 (minimization of data; exactitude; limitation of conservation; integrity and liability).
. In accordance with art. 13 of the Order of Council, 30 June 2003, no. 196, and of art. 13 of EU Regulation 2016/679, we hereby inform our users of all matters hereunder:
. The Data Controller, in accordance with and for the purposes of arts. 26 et seqq. of EU Regulation 2016/679 is aMDL s.r.l. (VAT 09029600153) in the person of the pro tem legal representative, trading at via Varese 15, 20121 Milano (MI);
. The said data controller, in accordance with and for the purposes of arts. 28 et seqq. of EU Regulation 2016/679, is Mr Pico De Lucchi, domiciled in Milan c/o aMDL s.r.l, at Milano 20121 Via Varese 15.
. The said data shall be used by aMDL s.r.l. for the purposes for which the party to whom the said data refer has given their consent.
. In particular, according to the necessities set forth on each occasion by users accessing the various sections of the site, the purposes of the personal data control conferred directly by the user through the compilation of on-line forms (as hereunder) CONSENT, can be the following:
. the granting of site registration, this being necessary to access particular sections of the said site, in order to provide and manage the various services offered: such as for example, enabling the user to purchase online the products offered;
. subject to the user’s consent and to the eventual revocation thereof, the implementation of marketing activities via email, as well as social apps (Facebook, Instagram, Twitter). The user concerned has the right to object at any time to the processing and management of their personal data for direct marketing purposes, in accordance with art. 21 of EU Regulation 2016/679 cit. as specified hereunder;
. mailing newsletter;
. replying to user requests relating to products under the brand name “Produzione privata”, and to publicity, i.e. to the internet sites www.amdl.it; www.micheledelucchi.it;www.produzioneprivata.com;
. subject to the user’s consent and up until any eventual revocation thereof, to conduct personnel research and selection.
The storage of all such data hinges solely upon those common data affected by their management.
The person concerned is therefore requested not to grant “sensitive” personal data (liable to reveal racial and ethnic origins, religious or philosophical convictions, political opinions, membership of parties and trade unions, besides personal data liable to reveal that person’s state of health or sexual life) and/or “judicial” data.
Should the applicant deem it indispensable to provide any such “sensitive” data, his or her curriculum shall be sent by ordinary postage to the data controller, aMDL s.r.l. operating at Milano 20121 Via Varese 15, enclosing his or her consent to the handling of any such data, duly dated and undersigned.
All such data shall be stored in our databases at our Human Resources Office, for a period of time not exceeding 6 months, subject to the applicant’s faculty to withdraw his or her application for employment, with the consequent cancellation of their data from our archives and the impossibility of any further consideration of that application.
. personal data recipients:
the user’s personal data shall be known to the owner and to the data controller, as well as to other parties expressly appointed by the said owner and controller (e.g. staff / collaborators / assistant to the owner), and finally also to the Provider, who shall keep them in the electronic “data log” cd register. Any such personal data may be communicated, by the owner to his own office as aforementioned, as well as to specialist businesses and agencies, including those headquartered in other countries, i.e. outside the EU, which may be providing the said owner with processing services or activities instrumental to that of the owner.
. Duration of data storage:
regarding data relating to traffic concerning users of the site and processed by the Provider, in accordance with art. 123 of EU Regulation cit., any such data shall be cancelled or rendered anonymous when no longer necessary to the purposes of the transmission of the electronic communication, subject to the exceptions set forth under subsections 2 and 3 of the said article (i.e. – subsection 2: handling may apply to data relating to traffic strictly necessary for the purposes of invoicing to the contracting party, for the purpose of documentation, in the event of disputation of an invoice or claim to payment, for a period, as customary, not in excess of six months; subsection 3: the aforementioned data may in addition, be handled for a period of time necessary for the purposes of selling electronic communication services or for the provision of value added services, after the user’s - revocable - consent).
. Rights of the interested party/user: the interested party has the right to ask the data controller for access to his or her controlled data, and to rectify or cancel those data, or for limitation of their handling, or to oppose their handling, besides the right to the portability of any such data, in accordance with arts. 15 – 22 of EU Regulation cit. and of art. 7 Privacy Code (insofar as compatible with European regulations), as set forth in due course. To exercise the aforesaid rights, the user must send an email to: firstname.lastname@example.org.
. Right to revocation of consent: whenever, as in the case in point, the data handling is based on consent, the right exists to revoke that consent at any time, without compromising the lawfulness of that revocation, based on the consent granted prior to any such revocation;
. The right to file a complaint to the controlling Authority;
. The communication of personal data is a necessary requisite to enable the user to access certain functions of the site, such as, for example, the online purchase of products presented and available in the e-catalogue, and subscription to the newsletter.
. The sites pertaining to the company aMDL s.r.l., viz: www.amdl.it, www.micheledelucchi.it; www.produzioneprivata.com, use profiling cookies, as better indicated both in the cookies’ banner, and in their extended information, set out in the first and third internet sites and intended herein as integrally reproduced.
1) Information on Privacy for the online purchase and sale of products under the brand name “Produzione Privata”
INFORMATION TO THE CLIENT IN ACCORDANCE WITH ART. 13 D.LGS. (order of council)(196/2003 (PRIVACY CODE) AND OF ART. 13 OF EU REGULATION 2016/679
In accordance with art.13 D.Lgs (order of council) 196/2003 and art. 13 of EU Regulation 2016/679, and in relation to the personal data of which aMDL s.r.l., as the owner of the brand name “Produzione Privata”, will take possession, we hereby inform you of the following:
aMDL s.r.l., in its capacity as owner of the brand name “Produzione Privata”, shall proceed with the management of personal data supplied by the Client for the online purchase of Products under the brand name “Produzione Privata” (hereinafter called “Products”), in compliance with regulations governing the protection of personal data and in a prevalently electronic form.
All such data handling shall have as its purpose the operations, or operations as a whole (such as, merely for the sake of example: collecting, recording, organisation, storage, processing, communication, modification, selection, use, cancellation, destruction), concerning the personal data supplied by the Client during the compilation and online dispatch of a Products Purchase Order.
In particular, the handling as aforesaid is carried out:
1.to fulfil any possible legal and/or regulatory obligations (e.g. fiscal and accountancy obligations), infra-group reporting, internal controls;
2.for the management and execution of the contract possibly concluded between aMDL s.r.l. and the Client with reference to products sold under the brand name “Produzione Privata”;
3.for the fulfilment of obligations deriving from and connected with the contract, such as, merely by way of example, and not exhaustively: the provision of transport and post-sales assistance services to clients.
With respect to the purposes set forth under points 1), 2) and 3), the granting of data, although optional, is necessary to the proper performance of the online purchase service, and any refusal to provide such data makes it impossible for aMDL s.r.l. to supply the aforesaid service.
For the correct implementation of the aforesaid activities, access to those data will be prevalently afforded to aMDL s.r.l.’s post-sales staff.
Furthermore, the data may be made available exclusively for the execution of activities delegated to them, to suppliers to aMDL s.r.l. providing services connected and functional to the aforesaid purposes, such as in particular, companies supplying IT services, including hosting services, and entities supplying commercial services in favour of aMDL s.r.l. (e.g. data entry, transport and delivery). These parties operate principally as responsible for the handling of aMDL s.r.l. data
The Client’s data shall not otherwise be communicated to or shared with third parties.
The Client’s data shall be stored only for the time strictly necessary to the execution of the activities set out under points 1), 2) and 3).
The data controller, in accordance with and for the purposes of arts 26 et seqq. of EU Regulation 2016/679, is aMDL s.r.l. (VAT 090229600153), in the person of the pro tem legal representative, operating in via Varese 15, 20121 Milano (MI).
The data controller, in accordance with and for the purposes of arts. 28 et seqq. of EU Regulation 2016/679, is Mr Pico De Lucchi, domiciled in Milan, c/o aMDL s.r.l., in Milano 20121, via Varese 15.
The Client, upon sending an online purchase order, declares that he or she has read and understood the present Terms & Conditions – Privacy Information” and thereby expresses his or her consent to the communication of their personal data and processing thereof, for the purposes and by the parties indicated under that same information.
In relation to the data handled, the Client shall have the faculty at any time to exercise his or her rights as recognised by art. 7 of the D.lgs (order of council) 196/2003 and arts. 15 -22 of EU Regulation 206/679 and, in particular, to obtain a copy of the data in question, of their updating, rectification or integration, their cancellation, conversion into anonymous form or blockage of handling with infringement of law, to oppose such handling for legitimate reasons.
To exercise those rights, the Client shall send an email to aMDL s.r.l. at: email@example.com.
2) Privacy Information for subscription to the NEWSLETTER on www.produzioneprivata.
-Purposes of the data handling
The personal data supplied by users are used for the sole purpose of circulating the newsletter and shall not be communicated to third parties.
Refusal to supply such data entails the impossibility of obtaining the newsletter service.
-Procedures for the handling of data
The data collected are processed with IT devices.
-The data controller
The data controller is aMDL s.r.l. (VAT 09029600153), in the person of the pro tem legal representative, operating in via Varese 15, Milan.
The processing of data connected to the newsletter service takes place at the aforesaid headquarters of aMDL s.r.l., under the supervision of staff allocated to the brand name “Produzione Privata”.
-The data processor
The person responsible for the data collected is Mr Pico De Lucchi, domiciled in Milan, c/o aMDL s.r.l., in Milano 20121 via Varese 15.
-Rights of interested parties
The parties to whom the personal data refer have the right, at any time, to obtain confirmation of the existence or non-existence of said data, and to be informed of their contents and origin, to ascertain their exactness or to request their integration or updating, or rectification (article 7 of the Code governing the protection of personal data and arts. 15 – 22 of EU Regulation 2016/679).
In accordance with the said regulations, the user has the right to request the cancellation, conversion into anonymous form or the blockage of any data processed in violation of the law, as well as to oppose their handling in any case, for legitimate reasons.
Requests should be made:
-via email, to the addresses: firstname.lastname@example.org, and to email@example.com.
§ Privacy Regulations governing the rights of the interested party
Listed below are the regulations relating to the rights which anybody who has supplied their personal data to aMDL s.r.l. and authorised their processing for a given purpose, has the faculty, at any time, to exercise, in accordance with art. 7 of D.Lgs (order of council) 196/03 – Privacy Code and arts. 15- 22 of EU Regulations 2016/679, by sending an email to: firstname.lastname@example.org.
Article 7 D.lgs (order of council) 196/2003 – Right of access to personal data and other rights:
1. The interested party has the right to obtain confirmation of the existence or non-existence of personal data concerning them, even if not yet registered, and their communication in an intelligible form.
2. The interested party has the right to obtain indications:
a. concerning the origin of their personal data;
b. concerning the purposes and procedures of their handling;
c. concerning the logic applied in the event of processing with the aid of electronic devices;
d. concerning the identifying references of the controller, managers and of the representative designated on Italian State territory, if so specified;
e. concerning the parties or categories of parties to whom the said personal data may be communicated or to whose knowledge the said data may come, in their capacity as designated representatives on Italian State territory, as managers or appointed persons.
3.The interested party has the right to obtain:
a. the updating, and rectification, i.e. whenever the party may so desire, the integration of said data;
b. the cancellation, conversion into an anonymous form or blockage of the data processed with infringement of the law, including any such data which it is not necessary to conserve in relation to the purposes for which those data were collected and subsequently handled;
c. certification that the operations specified under the above letters a) and b) have been brought to the knowledge, including with regard to their contents, of those persons to whom the said data were communicated or circulated, except when that certification may prove impossible or may entail a deployment of means manifestly disproportionate to the right protected.
4.The interested party has the right to oppose entirely or in part:
a. for legitimate reasons, the handling of personal data concerning him or her, even if pertaining to the purpose of their storage;
b. the handling of personal data concerning him or her for the purposes of sending publicity or direct sales material or for the conducting of market research or commercial communication.
- Listed below are the rights of the interested party according to EU Regulation 2016/679 (in force since 25.05.2018)
Article 15 – The interested party’s right of access
1.The interested party has the right to obtain from the data controller confirmation as to whether or not a processing of their personal data is in progress, and in which case, to obtain access to said personal data and to the following information:
a)the purposes of the processing;
b)the categories of personal data in question;
c)he recipients or categories thereof to whom the personal data have been or will be communicated, in particular if the recipients reside in other countries or among international organisations;
d)when possible, the scheduled period of conservation of the personal data or, if that is not possible, the criteria adopted to establish that period;
e)the existence of the interested party’s right to ask the data controller for the rectification or cancellation of said personal data, or for limitation of their processing or to oppose their handling;
f)the right to file a complaint to the controlling authority;
g)whenever the data are not stored at the interested party’s address, all available information about their origin;
h)the existence of an automated decision-making process, including profiling as stated under article 22, paragraphs 1 and 4 and, at least in such instances, meaningful information regarding the logic adopted, as well as the importance and consequences attached to that data control in respect to the interested party;
2.Should the said personal data be transferred to a different country or to an international organisation, the interested party shall have the right to be informed of the existence of proper guarantees, in accordance with article 46 relative to any such transfer.
3.The data controller shall supply a copy of the personal data being handled. In the event of further copies requested by the interested party, the data controller can debit that party for a reasonable contribution to the expenses incurred based on administrative costs. If the interested party files his or her request by an electronic device, and subject to any indication to the contrary from the interested party, the information shall be provided in an electronic format in everyday use.
4.The right to obtain a copy as per paragraph 3 shall not jeopardise other people’s rights and freedoms.
Article 16 – Right to rectification
The interested party has the right to obtain from the data controller the rectification of any inexact personal data referring to that party, without unjustified delay. Considering the purposes of said handling, the interested party has the right to obtain the integration of any incomplete personal data, including by supplying an integrative declaration.
Article 17 – Right to cancellation (“right to oblivion”)
1.The interested party has the right to obtain from the data controller the cancellation of personal data, without unjustified delay, and the data controller shall undertake to cancel any such personal data, without unjustified delay, if any one of the following motives subsists:
a)the personal data are no longer necessary to the purposes for which they were collected or otherwise handled;
b)the interested party revokes the consent upon which the handling is based in compliance with article 6, paragraph 1, letter a), or with article 9, paragraph 2, letter a), and if no other legal foundation for the handling subsists;
c)the interested party opposes the handling in accordance with article 21, paragraph 1, and no prevalent legitimate reason to proceed with the handling subsists, or the party opposes the handling in accordance with article 21, paragraph 2;
d)the personal data are illicitly processed;
e)the personal data must be cancelled to fulfil a legal obligation contemplated by the right of the Union or of the member State to which the controller is a party;
f)the personal data have been collected in relation to the offer of services by the IT company specified under article 8, paragraph 1.
2.The controller, if he or she has made personal data public and is obliged, in accordance with paragraph 1, to cancel them, taking into account the technology available and the costs of implementation, adopts reasonable, including technical, measures to inform the controllers who are processing the personal data by request of the interested party, to cancel any link, copy or reproduction of their personal data.
3.Paragraphs 1 and 2 are not applied in the measure in which the processing is necessary:
a)for the exercise of the right to freedom of expression and information;
b)for the fulfilment of a legal obligation requiring the data handling contemplated by the Union or by the member State to which the data controller is a party or for the performance of a task conducted in the public interest or in the exercise of public powers invested in the data controller;
c)for reasons of public interest in the public health sector in compliance with article 9, paragraph 2, letters h) and i), and of article 9, paragraph 3;
d)for the purposes of archiving in the public interest, for scientific or historical research or for statistical purposes compliant to article 89, paragraph 1, in the measure in which the right specified under paragraph 1 may be liable to make it impossible or to seriously jeopardise the accomplishment of the purposes of that data handling; or
e)for the ascertainment, exercise or defence of a right in a court of law.
Article 18 – Right to limitation of data control
1.The interested party has the right to obtain from the data controller the limitation of that control should one of the following circumstances occur:
a)the interested party disputes the exactness of their personal data, for the period necessary to the data controller to verify the exactness of said personal data;
b)the handling is illicit and the interested party opposes the cancellation of personal data and asks instead that their use be limited;
c)although the data controller no longer needs them for the purposes of their processing, the personal data are necessary to the interested party for the ascertainment, exercise or defence of a right in a court of law;
d)the interested party has opposed the processing in accordance with article 21, paragraph 1, pending a check on the possible prevalence of the data controller’s legitimate reasons over those of the interested party.
2.If the processing is limited in compliance with paragraph 1, these personal data may be processed, with the exception of their storage, only with the consent of the interested party or for the ascertainment, exercise or defence of a right in a court of law, or to safeguard the rights of another natural or legal person, or for reasons of relevant public interest of the Union or of a member State.
3.The interested party who has obtained limitation of the processing in accordance with paragraph 1 is informed by the data controller before the said limitation is revoked.
Article 19 – Compulsory notification in the event of rectification or cancellation of personal data or limitation of handling
The data controller shall inform each of the recipients to whom the personal data have been sent, of any possible rectifications or cancellations or limitations of the handling conducted in compliance with article 16, article 17, paragraph 1, and article 18, unless this proves impossible or entails a disproportionate effort. The data controller shall inform the interested party of those recipients should the interested party so request.
Article 20 – Right to data portability
1.The interested party has the right to receive in a structured format in everyday use and legible from an automatic device the personal data supplied to a data controller, and has the right to transmit those data to another data controller without impediment from the controller to whom he or she has supplied them, if and when:
a)the handling is based on consent as per article 6, paragraph 1, letter a), or article 9, paragraph 2, letter a), or under contract in accordance with article 6, paragraph 1, letter b); and
b)the handling is done using automated devices.
2.In exercising his or her rights to the portability of data in compliance with paragraph 1, the interested party has the right to obtain the direct transmission of said personal data from one handling controller to another, if technically feasible.
3.The exercise of the right as per paragraph 1 of the present article without prejudice to the contents of article 17. This right is not applied to processing necessary to the execution of a task of public interest or connected to the exercise of public powers invested in the person of the data controller.
4.The right as per paragraph 1 shall not jeopardise the rights and freedoms of other people.
Article 21 – Right of opposition
1.The interested party has the right, at any time for reasons connected to their particular situation, to oppose the handling of their personal data in accordance with article 6, paragraph 1, letter e) or f), including profiling on the basis of these provisions. The data controller shall abstain from any further processing of said personal data, unless he or she can prove the existence of legitimate cogent reasons for proceeding with that handling which prevail over the interests, rights and freedoms of the interested party or for the certification, exercise or defence of a right in a court of law.
2.Should the personal data be handled for direct marketing purposes, the interested party has the right, at any time, to oppose any processing of his or her personal data used for such purposes, including profiling in the measure in which it is connected to that direct marketing.
3.Should the interested party oppose his or her data handling for direct marketing purposes, the said personal data shall no longer be the subject of processing for those purposes.
4.The right as per paragraphs 1 and 2 shall be explicitly brought to the attention of the interested party and be set out clearly and separately from any other information, not later than at the moment of earliest communication with the interested party.
5.In the context of the use of services from the IT company and subject to the directive 2002/58/CE, the interested party may exercise their right to opposition by computer devices using specific technologies.
6.Should the personal data be handed for purposes of scientific or historical research or for statistical purposes as per article 89, paragraph 1, the interested party, for reasons connected with their particular situation, has the right to oppose that data handling, unless it is necessary to the performance of a task of public interest.
Article 22 – Computerised decision-making process relating to natural persons, including profiling
1.The interested party has the right not to be subjected to a decision based solely on computerised handling, including profiling, which may produce legal effects concerning him or her or which similarly and significantly affect his or her person.
2.Paragraph 1 does not apply whenever the decision:
a)is necessary to the conclusion and execution of a contract between the interested party and a data controller.
b)is authorised by the right of the Union or of its member State to which the data controller belongs, which furthermore explains measures suitable for the protection of the interested party’s rights, freedoms and legitimate interests;
c)is based on the interested party’s explicit consent;
3.In cases where in accordance with paragraph 2, letters a) and c), the data controller shall implement measures appropriate to the safeguarding of the interested party’s rights, freedoms and legitimate interests, and at least the right to obtain human intervention by the data controller, to express his or her opinion ad to dispute the decision.
4.The decisions set out under paragraph 2 are not based on the particular categories of personal data specified under article 9, paragraph 1, unless article 9, paragraph 2, letters a) or g) are applied, and unless adequate measures are in force for the protection of the interested party’s rights, freedoms and legitimate interests.