Privacy Policy

PRIVACY POLICY FOR THE PROCESSING OF PERSONAL DATA

The website www.vicolo.com (hereinafter the "Website") is owned by GGZ S.r.l. (VAT No. 01767000282), with registered office in Pozzonovo (PD) - Via Tezzon, No. 6/A.

With this privacy policy for the processing of personal data (hereinafter the "Privacy Policy"), GGZ S.r.l. informs each user of its website (hereinafter the "Data Subject") that the personal data provided when accessing the Website, interacting with it and using the services provided from time to time through the Website (hereinafter the "Services") will be processed in compliance with the provisions set forth below on the processing of personal data.

1. The Data Controller

The data controller of your personal data is the company GGZ S.r.l. (VAT No. 01767000282), with registered office in Pozzonovo (PD) - Via Tezzon, No. 6/A and registration number with the Companies' Register of Padua No. PD-179898 (hereinafter the "Data Controller").

The Data Controller’s email address is: info@vicolo.com.

2. Nature of data processed

Personal data of Data Subjects are processed, where personal data means any information relating to a natural person, identified or identifiable even indirectly by reference to any other information (the "Data").

Specifically, the Data that may be collected are as follows:

• Personal and contact information: first name, last name, social security number/tax code, physical address, e-mail, phone number and mobile phone number;
• other Data: should you choose to provide it: place and date of birth;
• the Data provided in case of information and service request, product returns and purchased product warranty;
• Geo-location data;
• Data pertaining to purchases and any preferences expressed.

The Data Controller, through the Website, also collects and records data related to the browser and the device used by the Data Subject for browsing. For more information on the processing of browsing data, you are invited to read the Cookie Policy.

3. Purpose of processing

Data are processed, as described in Section 7, for the following purposes:

A. for registration and access to restricted areas of the Website;

B. to answer to requests from the Data Subject sent by e-mail to the following address: customerservice@vicolo.com;

C. for the purchase of products on the Website and for functional and instrumental activities to the fulfilment of contractual relations, as well as for any necessary pre- and post-sales service;

D. for marketing activities, including also sending newsletters for information and promotion purposes (through conventional means and through electronic devices such as newsletters, e-mail, sms, mms and smart messages);

E. to send communications aimed at promoting products and services similar to those already purchased/used by the Data Subject (so-called “soft spamming"), without prejudice to the Data Subject's right to oppose at any time;

F. for profiling purposes, i.e., the study of consumption habits and choices, in order to make products, initiatives and individual business offers more responsive to the tastes and needs of its customers;

G. to identify the physical store closest to the Data Subject;

H. for the receipt of resumes in connection with the positions offered in the "Jobs" section of the Website (info@vicolo.com);

I. for the fulfilment of obligations under the law, regulations, EU legislation or an order of the Authority;

J. for the exercise of the Data Controller's rights, e.g., the right to defence in court;

K. to send forms aimed at evaluating the satisfaction of the Data Subjects with the services offered in the Website and the performance of the same.

4. Legal basis of processing and consequences of non-disclosure of Data.

The processing of the Data for the purposes set forth in Article 3 (A), (C) and (H) above has its legal basis in the fulfilment of a contract to which the Data Subject is a party or the fulfilment of pre-contractual measures taken upon request of the same pursuant to Article 6 (1) (b) of the GDPR. The provision of Data is not mandatory in nature, however, failure to provide it will result in the Data Subject being unable to access the restricted area and/or to use the Services of the Website, or, ultimately, to take part in the selection process.

Therefore, the provision of the Data requested upon activation of the Services is necessary for the purposes referred to in the preceding points as it is strictly functional to the performance of the Services requested, and the fulfilment of legal obligations. Any refusal to provide Data will result in the Data Controller's inability to provide the Services requested, and/or to fulfil its legal obligations.

The processing of Data for the purposes set forth in Article 3 (D) and (F) above has its legal basis in the consent to the processing of one's Data given by the Data Subject pursuant to Article 6 (1) (a) of the GDPR. The provision of data for these purposes is not mandatory: however, failure to provide it will result in GGZ S.r.l. being unable to keep the Data Subject updated on new products or services, promotions, customized offers, as well as to carry out market surveys and to send communications or other information that may be in line with the customer's interests.

The processing of Data for the purpose set forth in Article 3 (I) above is required to fulfil a legal obligation which the Data Controller shall undergo pursuant to Article 6 (1) (c) of the GDPR.

The processing of Data for the purpose set forth in Article 3 (B) and (K) above is required for the pursuit of the legitimate interest of the Data Controller, to answer any customer inquiries and to offer an ever-improving service to Data Subjects respectively, pursuant to Article 6 (1) (f) of the GDPR.

The processing of Data for the purpose set forth in Art. 3 (E) above is required for the pursuit of the legitimate interest of the Data Controller in informing the Data Subject about products similar or related to those already purchased in order to improve the shopping experience of its customers pursuant to Art. 6 (1) (f) of the GDPR and Art. 130, Paragraph 4 of Legislative Decree 196/2003 (Personal Data Protection Code).

The processing of Data for the purpose set forth in Article 3 (G) above is required for the pursuit of the legitimate interest of the Data Controller, in providing the Data Subject the address of the closest physical store, pursuant to Article 6 (1) (f) of the GDPR.

The processing of Data for the purpose set forth in Article 3 (J) above is required for the pursuit of the legitimate interest of the Data Controller in protecting its rights, pursuant to Article 6 (1) (f) of the GDPR.

The necessary nature of the provision of Data in order to enjoy the Service shall be indicated from time to time by affixing an appropriate symbol (*) to the information required for the enjoyment of the Services and the purchase of products on the Website. Failure to provide personal data indicated as optional will not result in any limitation or disadvantage to the user.

5. Study of consumption habits and choices

As indicated in paragraph 3 (F) above and with the express consent of the Data Subject, GGZ S.r.l. may process your Data for purposes of studying consumption habits and choices in order to make GGZ S.r.l.'s products and initiatives more responsive to the tastes and needs of its customers.

GGZ S.r.l., with the help of automated tools, will process Data regarding the frequency and value of purchases, as well as the type of products purchased. Data pertaining to consumption and preferences may be collected not only by tracking purchases made both on the Website and in GGZ S.r.l.'s physical stores, but also through the Data Subject's interaction with GGZ S.r.l. and any information that the user may voluntarily provide. This study has the sole objective of offering to customers and Data Subjects products, services and initiatives which are more responsive to their tastes and needs. The Data Subject may at any time revoke consent to the processing of Data for this purpose and request clarifications regarding the logics applied, as well as the modification of the results obtained by contacting GGZ S.r.l. at the contact details indicated.

6. Procedures of Data Processing

The Data collected through the Website are processed using mainly computer and electronic methods and tools, thus adopting the necessary security measures in order to minimize the risks of destruction or loss, even accidental, of the data themselves, unauthorized access or not permitted or not conforming processing to the collection purposes indicated in this Policy.

7. To whom the Data may be disclosed

The Data processed by the Data Controller will not be disseminated, i.e., it will not be disclosed to unspecified parties.

The Data may, on the other hand, be disclosed to the employees of the Data Controller and to certain external parties that collaborate with the same, within the limits of the purposes indicated in this Policy. Finally, they may be communicated to the subjects entitled to access them by virtue of provisions of the law, regulations and rules.

The Data may be disclosed, exclusively for the above purposes and limited to what is strictly necessary, to the categories of subjects indicated below:

(a ) persons, companies, associations or professional firms that provide services and activities of assistance and advice to GGZ S.r.l., with particular but not exclusive reference to issues in accounting, administrative, legal, tax and financial matters;

(b) companies that carry out specific technical and organizational services related to the Website (logistics services, IT services and marketing services) for GGZ S.r.l., as data processors and that have signed a special contract punctually regulating the processing entrusted to them and the obligations regarding data protection;

(c ) third parties, solely to fulfil the contract for the purchase of products on the Website (such as the bank for the execution of remote electronic payment services by credit/debit card, the delivery company);

(d) third parties

In addition, the Data collected may be disclosed to public or private entities for the fulfilment of obligations required by law.

8. Retention period

Data are retained only for as long as necessary to achieve the purposes for which they were collected as well as to fulfil legal obligations imposed for the same purposes. In any case, the Data will not be processed for the purpose whose retention period has expired.

For the sake of completeness, below are the retention times in relation to the different purposes listed above:

• to answer the Data Subject's requests sent by e-mail: the Data will be processed for the time necessary to fulfil the question and/or request;
• for the fulfilment of contractual relationship and consequent obligations: the Data will be kept for the duration of the contract and in any case no longer than the next 10 years, for tax and accounting purposes;
• for sending resumes for positions offered in the "Work with Us" section of the Website: the Data will be kept for 6 months after receipt;
• for sending newsletters for information and promotion purposes: the Data processed for marketing purposes will be retained until the user revokes his/her consent (in any case for a period not exceeding 24 months from the date on which said consent was given for this purpose). Prior to the expiration of this period, GGZ S.r.l. may contact the Data Subject to verify whether he/she wishes to continue receiving communications about products, services, offers, news and events related to the VICOLO brand;
• for profiling purposes: purchase detailing Data will be processed for a maximum period of 12 months from the registration of the same.

At the end of the Personal Data Processing period, the Personal Data will be deleted, i.e., permanently anonymized.

9. Data Subjects’ Rights

In relation to the Data which are the subject of the processing referred to in this Policy, the Data Subject is entitled at any time to:

- Access: the Data Subject has the right to obtain confirmation from the Data Controller that Data concerning him or her is or is not being processed and, to obtain access to the Data and information referred to in Article 15 of the GDPR, in which case the Data Controller shall provide a copy of the Data being processed. Where the Data Subject requests additional copies, the Data Controller reserves the right to charge a reasonable fee based on administrative costs.

- Rectification and integration (Art. 16 GDPR): the Data Subject has the right to obtain from the Data Controller the rectification of inaccurate Data concerning him/her without undue delay. Taking into account the purposes of the processing, the Data Subject has the right to obtain the integration of incomplete Data, including by providing a supplementary declaration.

- Deletion: the Data Subject has the right to obtain from the Data Controller the deletion of the Data concerning him/her without undue delay, and the Data Controller has the obligation to delete the Data without undue delay, if any of the grounds set forth in Article 17 of the GDPR occur;

- Restriction: the Data Subject has the right to obtain from the Data Controller the restriction of the processing when one of the hypotheses set forth in Article 18 of the GDPR occurs. If the processing is restricted, the Data are processed, except for retention, only with the consent of the Data Subject or for the establishment, exercise or defence of a right in a court of law or to protect the rights of another natural or legal person or for reasons of important public interest of the Union or a Member State;

- Portability of one's Data (Art. 20 GDPR);

- Objection to processing (Art. 21 GRPR): the Data Subject has the right to object at any time, on grounds relating to his or her particular situation, to the processing of Data relating to him or her, pursuant to Article 6 (1) (f) of the GDPR, in which case, the Data Controller shall refrain from further processing the Data unless he or she demonstrates the existence of compelling legitimate grounds for processing which override the interests, rights and freedoms of the Data Subject or for the establishment, exercise or defence of legal claims. The Data Subject may object at any time to the processing of Data for soft spamming purposes, either by using the opt-out option present in every commercial communication or by sending an e-mail to customerservice@vicolo.com.

- Withdrawal of consent (Art. 7 (3) GDPR): the Data Subject has the right to withdraw his/her consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent prior to withdrawal. The Data Subject may withdraw at any time his/her consent to the processing for marketing purposes, either by using the opt-out option present in every commercial communication or by sending an e-mail to customerservice@vicolo.com.

The Data Controller shall provide the Data Subject with information about the actions taken regarding a request submitted by the Data Subject without undue delay and, in any case, no later than one month after receipt. This deadline may be extended by two months if necessary, taking into account the complexity and number of requests. The Data Controller shall inform the Data Subject of such an extension, and the reasons for the delay, within one month of receipt of the request. If the Data Subject submits the request by electronic means, the information shall be provided, where possible, by electronic means, unless otherwise specified by the Data Subject.

10. How to exercise your rights

The Data Subject may at any time exercise his/her rights, referred to in the preceding paragraph, by sending:

- a registered letter with return receipt to GGZ S.r.l., at its registered office in Pozzonovo (PD) - Via Tezzon, No. 6/A;

- an e-mail to customerservice@vicolo.com.

11. Complaint

The Data Subject also has the right to submit a complaint to the supervisory authority; for Italy, the supervisory authority is the Data Protection Authority, whose contact details are available at www.garanteprivacy.it

12. Privacy Policy Updates

This Policy is subject to occasional revision. Should amendments be introduced to the processing, GGZ S.r.l. will update this Policy. Where required by current regulations, the Data Subject will have the option to give consent to any new processing. In case of refusal, the Data Subjects' Data will not be processed according to the amendments provided in the Policy.

Last Updated

15.02.2023