Privacy Policy

Dear User/Interested Party,
This Privacy Notice is provided pursuant to Legislative Decree No. 196 of June 30, 2003, and subsequent amendments (known as the Privacy Code), as well as pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016.
We inform you that the personal data you provide in the context of browsing the website www.cloet.it, return to purchasing products marketed by the company CLO'ET Design S.r.l. and/or to receive a periodic newsletter from the aforementioned company, related to the products it markets, will be processed by the said company as the Data Controller (hereinafter also referred to as the Controller) in compliance with the protection principles established by the Code on personal data and subsequent amendments, as well as all European and national legislative measures and/or decisions by the Supervisory Authorities.
The following information is provided for this site only. www.cloet.it and not for other websites
eventually consulted by the User via a link that redirects you.

A. PURPOSE OF THE PROCESSING

The processing of data voluntarily provided by the User in order to purchase products marketed by Clo'et is carried out by the Data Controller to allow them to:
• allow the user to purchase products owned by the Data Controller;
• ship the products purchased through this website to the user;
• comply with legal obligations regarding accounting and taxation;
• to facilitate the provision of any future services or to facilitate any future purchases
that the user wishes to carry out on this site or at facilities owned by CLO'ET Design S.r.l., through the sending of newsletters and/or advantageous commercial offers to the User, with their prior consent.
• for marketing purposes and therefore in order to profile the User and consequently send them appropriate commercial offers. This processing is optional and will only be carried out with the User's consent.

B. TYPES OF DATA COLLECTED AND PROCESSED

In order to purchase products marketed by the Data Controller, the User must necessarily provide the following information:
• First name, last name;
• Email;
• residence, domicile, shipping, or dwelling address: • date of birth / User's birthday;
• landline and/or mobile phone.
Such data are defined as common data.
The data controller will also necessarily become aware of the User's banking data, which are to be considered sensitive data.
The data marked with the "mandatory" field are required in order to purchase the products sold by CLO'ET Design. S.r.l. The owner will necessarily come into contact with the banking data since the purchase of the products can only be completed by making the required payment.
To receive the newsletter and advantageous commercial offers from the Data Controller (for Marketing purposes), the User must necessarily provide the following data:
• First name, last name;
• Email;
• User's date of birth / birthday;
• User's region of residence.
Without prejudice to the personal autonomy of the Interested Party and without prejudice to the granting of
Navigation data, the indication of data marked as "mandatory" in the form is essential, and the failure to provide, even partially, the data expressly indicated as necessary will result in the impossibility for the Data Controller to proceed with sending newsletters and/or advantageous commercial offers.

C. DATA CONTROLLER, MANAGERS, AND AUTHORIZED PERSONNEL

The Data Controller is the company CLO'ET Design. S.r.l. in the person of the temporary legal representative (VAT number 04506250168), with its registered office at 24122 – Bergamo (BG), via Giacomo Quarenghi 17.
Please be informed that the provided Data may be processed by other parties involved in the organization of the Data Controller, all acting as data processors, or by external parties (such as third-party technical service providers, hosting providers, platforms for delivering training courses), appointed as processors or, if necessary, External Data Processors by the Data Controller.

D. METHODS OF PROCESSING

The personal data provided will be processed at the Data Controller's headquarters by Authorized Subjects and/or Internal Managers, or by External Data Processors appointed by the Data Controller (providers of IT and logistics services; providers of outsourcing and cloud computing services and management services; external professionals and consultants; companies tasked with carrying out marketing and/or shipping activities). The processing will take place through IT and/or electronic procedures in the ways and within the limits necessary to pursue the aforementioned purposes and will be stored at the same location.
The Owner makes use of services provided by leading companies in the sector tasked with carrying out development and maintenance activities for management software and the technical maintenance of the site.

E. TRANSFER OF DATA TO THIRD COUNTRIES

The Data Controller declares that the processed data is not transferred to third parties.

F. RETENTION PERIOD

You are informed that the Data provided will be processed and stored by the Controller for the purposes mentioned above and kept by the Controller for the timeframes indicated below.
In the case of invoicing, thus purchasing products marketed by the Data Controller, the data related to the purchases made will be retained for 10 years from the date of invoicing, as required by the applicable accounting and tax law.
In the event that you have consented to the processing of your personal data for marketing purposes and/or newsletter sending, your personal data will be processed until you revoke your consent for the processing of your data for marketing purposes for all or some of the contact methods, unless the retention of your data is still necessary for other purposes covered by this privacy notice. You can revoke your consent via a specific link available in any commercial communication you receive.
The personal data collected for purposes related to the legitimate interest of the Data Controller will be retained until the fulfillment of that interest.

G. RIGHTS OF THE DATA SUBJECT

The interested party can at any time exercise their rights with respect to the Data Controller of the
treatment in accordance with Legislative Decree 193/2006 and Regulation (EU) 2016/679 as referred to by the following articles:
I. RIGHT OF ACCESS FOR THE DATA SUBJECT – Art. 15 Reg. (EU) 2016/679
II. RIGHT OF RECTIFICATION – Art. 15 Reg. (EU) 2016/679
III. RIGHT TO ERASURE ("RIGHT TO BE FORGOTTEN") – Art. 17 Reg. (EU) 2016/679
IV. RIGHT TO RESTRICTION OF PROCESSING – Art. 18 Reg. (EU) 2016/679
V. RIGHT TO DATA PORTABILITY – Art. 20 Reg. (EU) 2016/679
VI. RIGHT TO OBJECT – Art. 21 Reg. (EU) 2016/679

GENERAL RULES FOR EXERCISING RIGHTS

We inform you that the rights mentioned in the preceding paragraphs can be exercised at any time by sending an email to the following address: supporto@cloet.it, along with a digital copy of your valid identity document.
We remind you that if you ask us to stop all processing of your personal data and not just for promotional purposes, we will not be able to continue providing you with the services you have requested. Unless you request to stop only the sending of promotional communications through automated systems, we will cease all processing of your personal data, including through traditional means, in the case of a general request.
In any case, our company may retain certain personal data if it is necessary to defend or assert its own rights.
Where desired, the updated list containing the names of the Data Processing Managers is available to you at the Data Controller's office, which you can also request via email by writing to support@cloet.it.

Definitions

Article 5 GDPR

For the purposes of this regulation, it is meant by:
Personal data: any information concerning an identified or identifiable natural person, also referred to as the "data subject"; an identifiable natural person is one who can be identified, directly or indirectly, with particular reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to their physical, physiological, genetic, mental, economic, cultural, or social identity.
Processing: any operation or set of operations performed with or without the aid of automated processes and applied to personal data or sets of personal data, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or any other form of making available, comparison or interconnection, restriction, erasure or destruction;
Restriction of processing: the marking of stored personal data with the aim of limiting their processing in the future;
Profiling: any form of automated processing of personal data consisting of the use of such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning the professional performance, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements of that natural person; Pseudonymization: the processing of personal data in such a way that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and subject to technical and organizational measures intended to ensure that such personal data is not attributed to an identified or identifiable natural person;
Archive: any structured set of personal data that is accessible according to specific criteria, regardless of whether the set is centralized, decentralized, or distributed functionally or geographically;
Data Controller: the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; when the purposes and means of such processing are determined by Union or Member State law, the data controller or the specific criteria
applicable to its designation may be established by Union law or by the law of the Member States;
Data Processor: the natural or legal person, public authority, agency, or other body that processes personal data on behalf of the data controller;
Recipient: the natural or legal person, public authority, agency, or another body that receives disclosure of personal data, whether or not it is a third party. However, public authorities that may receive disclosure of personal data in the context of a specific investigation in accordance with Union or Member State law are not considered recipients; the processing of such data by these public authorities complies with the applicable data protection rules according to the purposes of the processing;
Third party: the natural or legal person, public authority, agency, or other body other than the data subject, the data controller, the data processor, and the persons authorized to process personal data under the direct authority of the controller or processor;
Consent of the data subject: any freely given, specific, informed, and unambiguous indication of the data subject's wishes, by which they, through a statement or clear affirmative action, signify their agreement to the processing of personal data relating to them;
Personal data breach: the security violation that involves the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data that is transmitted, stored, or otherwise processed;
Genetic data: personal data related to the hereditary or acquired genetic characteristics of an individual that provide unique information about the physiology or health of that individual, and which result particularly from the analysis of a biological sample of the individual in question;
Biometric data: personal data obtained from a specific technical processing related to the physical, physiological, or behavioral characteristics of an individual that allow or confirm their unique identification, such as facial images or fingerprint data;
Health data: personal data related to the physical or mental health of a natural person, including the provision of healthcare services, which reveal information about their health status;
Main facility:
a) with regard to a data controller with establishments in more than one Member State, the location of its central administration in the Union, unless decisions on the purposes and means of processing personal data are made in another establishment of the data controller in the Union and that establishment has the power to implement those decisions,
in which case the establishment that has made such decisions is considered to be the main establishment;
b) with reference to a data controller with establishments in more than one Member State, the place where its central administration in the Union is located or, if the
If the controller does not have a central administration in the Union, the establishment of the controller in the Union where the main activities are conducted
processing activities in the context of the activities of an establishment of the controller to the extent that such a controller is subject to specific obligations under this regulation;
Representative: the natural or legal person established in the Union who, designated by the
data controller or by the data processor in writing pursuant to Article 27, represents them with regard to their respective obligations under this regulation;
Enterprise: the natural or legal person, regardless of the legal form taken, that conducts an economic activity, including partnerships or associations that regularly engage in economic activity;
Business group: a group composed of a parent company and the companies it controls;
Binding corporate rules: the data protection policies applied by a data controller or processor established in the territory of a Member State to the transfer or set of transfers of personal data to a data controller or processor in one or more third countries, within a corporate group or a group of enterprises engaged in a joint economic activity;
Supervisory Authority: the independent public authority established by a Member State pursuant to Article 51;
Supervisory Authority Concerned: a supervisory authority affected by the processing of personal data because:
a) the data controller or the data processor is established in the territory of the Member State of that supervisory authority;
b) the data subjects residing in the Member State of the supervisory authority are or are likely to be substantially affected by the processing; or
c) a complaint has been submitted to that supervisory authority;
Cross-border treatment:
a) processing of personal data that takes place within the activities of establishments in more than one Member State of a data controller or processor in the Union where the data controller or processor is established in more than one Member State; or
b) processing of personal data that takes place within the activities of a single establishment of a controller or processor in the Union, but which affects or is likely to substantially affect data subjects in more than one Member State;
Relevant and motivated objection: an objection to the draft decision on whether there is a violation of this regulation, or whether the proposed action in relation to the data controller or processor is in compliance with this regulation. The objection clearly demonstrates the relevance of the risks posed by the draft decision concerning the fundamental rights and freedoms of the data subjects and, where applicable, the free movement of personal data within the Union.
Information society service: the service defined in Article 1, paragraph 1, letter b), of Directive (EU) 2015/1535 of the European Parliament and the Council (19); International organization: an organization and bodies governed by public international law subordinate to it, or any other body established by or on the basis of an agreement between two or more States.

Data Controller

CLO'ET DESIGN SRL – Via G. Quarenghi, 17 – 24122 Bergamo (Bg)

Email address of the Owner:Support@cloet.it