PRIVACY POLICY ON PERSONAL DATA PROCESSING
pursuant to Art. 13 of Legislative Decree no. 196 of 30.6.2003 and Art. 13 of European Regulation 679/2016

Manifattura Valcismon respects the privacy of its users. The personal data sent by users to Manifattura Valcismon will be processed with the utmost care and with all the tools to guarantee its security, in full compliance with European legislation for the protection of privacy.

This privacy policy describes the purposes and methods of processing the personal data of users through the www.castelli-cycling.com website, with specific reference to the categories of personal data processed, the identification of the data controller, the maximum period of retention of personal data and the main guarantees designed to protect the privacy rights of users.

“Personal data” means any personal data and any information concerning a natural person identified or identifiable, even indirectly, or information concerning a person whose identity can still be ascertained by means of additional information (Art. 4 GDPR).

“Processing” of personal data means any operation carried out concerning the collection, recording, organisation, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, dissemination, deletion and destruction of personal data, even if not recorded in a database (Art. 4 GDPR).

As required by applicable law, the processing of personal data carried out by the data controller will always and absolutely be based on the principles of correctness, lawfulness and transparency and protection of confidentiality.

Browsing on the website is free, without charge and reserved for adults and does not require registration on the site. The provision of data by users is not mandatory, except for achieving the purposes indicated below; in any case, it can be revoked at any time by the user by sending a simple written request to the data controller. 

The information on the site is provided by the data controller free of charge and in good faith; under no circumstances can the data controller be held responsible for any direct or indirect damage caused by the use of the site. This privacy policy may be subject to updates without prior notice; the user, by continuing to browse the site, fully and automatically accepts any changes.

The privacy policy is provided only for the site and not for other websites that may be visited by the user through referral links; in the latter case, the privacy policy on the processing of personal data will be provided by the owner of the third party website.

Data Controller

The data controller is Manifattura Valcismon S.p.A., with registered office in Via G. Marconi 81/83, 32030 Fonzaso (BL), Italy (the “Data Controller”).

The owner informs that they have appointed a Data Protection Officer (hereinafter "DPO"). The DPO can be contacted at the following address: dpo@mvc46.eu.

Categories of personal data processed

The data controller collects and processes the following categories of personal data:

1. Data arising from the user's browsing on the site: the so-called “browsing data” is acquired automatically during the user’s browsing on the site and is required for the proper operation of the site itself. This data is not collected for the purpose of identifying the User but only for the purpose of obtaining anonymous statistical information in aggregate form on the use of the site as well as to verify its correct operation. The browsing data may be disclosed by the data controller to the competent authorities, in the event of cyber crimes that damage the site and may be used by the authorities for the assessment of responsibilities and the identification of those responsible.
2. Data provided spontaneously by the user who voluntarily interacts with the site through the “Contact us” (“Contattaci”) and “Let me know” (“Avvisami”) sections or contacts Manifattura Valcismon in any other way.
3. Data provided spontaneously by the user who, through the appropriate section of the Site, registers the account or subscribes to the newsletter.
4. Data provided by the user to execute a purchase order on the Site. 

Purposes for personal data processing

The personal data provided by users will be processed by the data controller for the following purposes:

1. Interacting with the user to respond to their requests for information or assistance.
2. Fulfilling the sales contract concluded with the user, as well as sending communications about the product; by way of example but not limited thereto, any technical, commercial and administrative communications.
3.  Allowing the data controller to carry out the operations strictly connected and instrumental in the correct management of relations with Users.
4. Carrying out anonymous and aggregated statistical analyses.
5. Implementing legal obligations or current regulations.
6. Managing any complaints and allowing the data controller to protect its rights;
7. Contacting the user by telephone or email, having received their express consent, for marketing purposes, direct sales and/or sending promotional and commercial communications, for carrying out market research and other advertising activities targeting the user.

In relation to the processing of personal data referred to in point no. 7, the consent of the data subject is optional; however, in the event of non-consent, it will not be possible to send commercial and promotional communications.

In relation to the remaining purposes, the provision is a contractual obligation required for the conclusion of the contract or in any case necessary for the provision of the requested services. The data subject has the right not to provide personal data; in case of failure to provide such data, however, it will not be possible to conclude any contract.

Processing methods

Data will be processed in a lawful manner, according to fairness and in compliance with the principles of necessity, relevance, completeness and non-excess of the data collected with respect to the purposes of the processing.

The data controller will process the user's data electronically in order to ensure, in relation to the purposes for which the data was collected, the security and confidentiality, and also to prevent unauthorised access to the data.

The data will be processed and stored at the local unit of the data controller, located in Fonzaso (BL), and on servers located within the European Union for European citizens, in Australia for Australian and Japanese citizens and within the United States of America for US and Canadian citizens.

The data will only be processed by personnel specifically assigned to the processing and by the data processors appointed by Manifattura Valcismon.

For some processing operations, the Data Controller may also use third parties which must, in any case, comply with the instructions specifically given by Manifattura Valcismon to ensure the security and confidentiality of the data entrusted to them.

Disclosure of personal data

For the achievement of the purposes indicated above, the data controller may need to disclose the User's personal data to third parties belonging, by way of example but not limited thereto, to the following categories: subsidiaries, parent companies and associated companies; parties, including third parties, involved in the execution of purchase orders, both during the sale and after-sales phase; parties who carry out customer service activities (e.g. Call centres, etc.); parties who carry out filing and data entry activities; professional firms and companies in the sphere of assistance and consultancy relationships; parties that carry out market research on behalf of Manifattura Valcismon.

The subjects belonging to the above categories will process the data of Users as Data Processors, appointed for this purpose by the Data Controller. The list of third parties to whom the data controller will disclose the data is available for consultation at the registered office of the controller. 

The personal data processed for the purposes indicated above are not subject to unauthorised disclosure. 

In all other cases, the disclosure or dissemination of personal data is subject to the prior express and unambiguous consent of the data subject.

This is without prejudice to the disclosure or dissemination of personal data where requested by the judicial authority, by other public entities for the purposes of State defence or security or for the prevention, detection or repression of administrative or criminal offences, and in any case in cases where the disclosure or dissemination of Personal Data is required by law. 

The Data Controller does not transfer personal data to places and territories located outside the European Economic Area (EEA) lacking in an adequate level of protection of personal data without the prior and unambiguous consent of users and data subjects.

Personal data retention period

The Data Controller will process and store the data for a period not exceeding that necessary with respect to the purposes identified above.

In particular, the personal data processed for the purposes indicated above will be stored for the duration of the contract and for a period of time necessary and sufficient to provide the services requested by users; subsequently, for the time in which the Data Controller is subject to storage obligations for tax purposes, beyond the purposes provided for by legal or regulatory provisions. 

The Data Controller will proceed to promptly delete or anonymise any personal data that is no longer necessary. In particular, Manifattura Valcismon will delete the accounts deleted by users at the first useful update, and in any case within 60 days of receipt of the request by the user.

Users’ rights

In relation to the aforementioned processing of personal data, any data subject may exercise the rights provided for by the GDPR. In particular:

The data subject is entitled to get confirmation of the existence or otherwise of personal data concerning him/her, even if not yet recorded, and the communication thereof in intelligible form.

The data subject also has the right to know:

• what the source is of the personal data processed;
• the purposes and legal basis for processing;
• the legitimate interests that may be pursued by the data controller, where these constitute the legal basis for the processing itself;
• the existence of an automated decision-making process, including profiling;
• the identification details of the person that processes the data;
• the period of time the personal data is stored.

The data subject also has the right to ask the Data Controller for his/her personal data to be:

• updated, rectified or (where the data is incomplete) supplemented;

• deleted, if:

1. the data is no longer necessary for the purposes for which it was collected or processed;
2. the data subject withdraws consent or objects to the processing;
3. the data is processed unlawfully or must be deleted in order to comply with a legal obligation;

• limited in its processing, if:

1. the data is inaccurate or is unlawfully processed or the data subject has objected to it being processed;
2. despite the data controller no longer needing it for the purposes of processing, it is necessary for the data subject to uphold a right in court;
3. transferred to another controller (so-called right to portability), if the processing is based on consent and is carried out by automated means.

The data subject has the right to object, entirely or in part:

• to the processing of personal data concerning him/her, for legitimate reasons, even if pertinent to the purpose of collection;
• to the processing of their personal data for the purpose of sending advertising or direct sales material or for carrying out market research or commercial communications.

The data subject has the right to lodge complaints in relation to the collection and processing of personal data with the Italian Data Protection Authority or any other competent supervisory authority.

Communications

For any communication to the Data Controller relating to privacy issues or to exercise their rights, users can contact the Data Controller at +39 0439-5711, by fax at +39 0439-56436 or by email at: privacy@mvc46.eu.