INFORMATION NOTICE PURSUANT TO ARTICLE 13 OF EU REGULATION 2016/679 (“GDPR”) ON THE PROCESSING OF PERSONAL DATA
Dear User,
Thank you for your interest in our configurator. ASTOLFI 1963 S.R.L. provides the following information required by the GDPR regarding the processing of personal data resulting from your use of our service (hereinafter referred to as the “Service”).
1. Data Controller
The Data Controller is ASTOLFI 1963 S.R.L., Strada Geronima 2, Sacile (PN), email info@astolfi1963.com (hereinafter referred to as the “Controller”).
| Purpose of Processing | Legal Basis | Retention Period |
|---|---|---|
| Enable use of the automated configuration Service. | Performance of a contract or pre-contractual measures requested by the data subject. |
Without a contract: up to 4 months. With a contract: duration of the contract and up to 10 years after its termination. |
| Fulfill administrative, accounting, tax, and other legal obligations for paid services. | Compliance with a legal obligation to which the Controller is subject. | As indicated for contractual and tax purposes. |
| Send communications about discounts, new products, services, or options related to the Service and configured product. | Legitimate interest of the Controller and “soft spam” under Art. 130(4) of the Privacy Code. | As indicated above and until the data subject objects. |
| Conduct "customer satisfaction" initiatives to gather feedback on service quality. | Legitimate interest of the Controller to improve services based on customer feedback. | Until survey results (anonymized) are processed. |
| General marketing: send communications, newsletters, and advertising material about the Controller’s services. | Consent of the data subject. | As indicated for marketing purposes and until consent is withdrawn. |
|
After the above-mentioned retention periods have elapsed, the data will be destroyed, deleted, or anonymized, in accordance with the technical timelines for deletion and backup. |
3. Provision of data
Provision of data. The provision of data marked with an asterisk in the registration form is necessary for the use of the Service; failure to provide such data will prevent the use of the Service and the submission of the order.
4. Categories of recipients
The data of the data subject may be disclosed to additional entities acting as independent controllers (e.g., public authorities, supervisory and control bodies, professional firms) authorized to receive them.
The data may also be processed, on behalf of the Controller, by third parties designated as processors pursuant to Article 28 of the GDPR, such as individuals and/or legal entities performing activities essential to achieving the purposes specified above (e.g., IT service providers, marketing and communication companies, etc.).
5. Transfer of personal data to non-European Union countries
Data may be transferred to countries outside the European Union as part of the Controller’s collaboration with selected technology partners. Where data is transferred to countries outside the European Union (EU) or the European Economic Area (EEA) that have not been deemed adequate by the European Commission, and where the transfer is not necessary for the execution of the contract, “transfer tools” under Article 46 of the GDPR will be used, assessing the potential implementation of “supplementary measures” to ensure a level of protection substantially equivalent to that required under European Union law.
6. Rights of the data subject
The data subject, i.e., the individual to whom the personal data refers, may obtain confirmation from the Controller as to whether or not personal data concerning them is being processed and, if so, access such data and the information referred to in Article 15. They may request the rectification of inaccurate data, the completion of incomplete data, the erasure of data in cases provided for under Article 17, the restriction of processing in cases provided for under Article 18 of the GDPR, and object, on grounds relating to their particular situation, to processing carried out based on the Controller’s legitimate interest.
The data subject also has the right, provided all conditions for data portability are met, to receive their data in a structured, commonly used, and machine-readable format and, if technically feasible, to transmit them to another controller without hindrance.
The data subject also has the right, at any time, to withdraw the consent given and to object to the processing of data for marketing purposes.