Statement to web users regarding registration on the site

Check your email and click on "Subscribe".
Privacy statement
Information to be provided ex art. 13, GDPR

Data controller – Identity and contacts
The Data Controller is Giordano Vini spa (hereinafter: “Giordano” or “the Controller”), having registered office in Via Cane Guido 47 bis/50, 12055 Diano d’Alba (CN – Italy) – VAT IT04642870960.

Data source and purposes of processing
Personal data are provided by the data subject filling in the registration form and managing the profile. 
Personal data are processed for the following purposes:
1.	to grant the registration request and activate the user’s profile, as well as to provide services reserved to the registered users, including the management of the profile, and to send information on the features and services of the website
2.	to comply with laws, regulation and EU legislation  
3.	to contact you for direct marketing purposes on our services and products, for distance selling, surveys and market research
4.	profiling activities carried out to analyse your personal preferences, interests, purchasing behaviour, and contact you for marketing purposes. Profiling is carried out analysing data stored in our filing systems and/or provided to us by third parties 
5.	to communicate data to third parties operating in direct marketing and distance selling for their autonomous processing carried out for direct marketing purposes through direct mailing  
6.	to communicate personal data to third parties for their autonomous processing having the purpose of e-mail marketing, telemarketing, Sms marketing and other means of electronic commercial communication.

Means of data processing
1.	Personal data are processed by the Controller with manual, electronic and telematic means and stored in its filing system. Appropriate security measures are applied to prevent data from loss or alteration – even if accidental – unlawful or improper uses or unauthorised access. 
2.	Profiling to the extent which it is related to direct marketing referred to in point 4, “Data source and purposes of processing” will be carried out with automatic means by Giordano, analysing preferences and/or data subject’s behaviour (e.g.: personal characteristics according to the questions asked, subjects of interest, products on which the user has asked for information). So, Giordano will carry out processing which implies the selection of data stored on the data subject, so as to contact the person to inform on offers and promotional campaigns, surveys and market research which are of interest and in line with preferences, avoiding nuisance advertising. This operation of profiling may be carried out also using information provided by third parties
3.	For the execution of direct marketing activities – with or without profiling – referred to in points 3. and 4., “Data source and purposes of processing”, the Controller uses the contacts details that have been provided by the data subject and the means of contacts which are usually preferred by the data subject. Therefore, the contacts may be carried out through traditional (e.g.: mailing, vocal calls) and electronic communication means (e.g.: e-mail, Sms).

Legal basis for the processing
Depending on the purposes of processing referred to in the paragraph “Data source and purposes of processing”, the legal bases are:
1.	for the purposes referred to in point 1., “Data source and purposes of processing”, the legal basis is art. 6, par. 1, letter b), GDPR, since processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. In this case, to allow the user to register to the website and use the services reserved to registered users
2.	for the purposes referred to in point 2., “Data source and purposes of processing”, the legal basis is article 6, par. 1, letter c), GDPR, since the processing is necessary for compliance with a legal obligation to which the Controller is subject
3.	for the purpose referred to in point 3., “Data source and purposes of processing”, the legal basis is the “legitimate interest” (art. 6, par. 1, letter f), GDPR, preamble 47, GDPR and Opinion 6/2014 of Working Party 29, par. III.3.1.) pursued by Giordano in keeping in touch with the user who has registered to the website, and, in doing so, the user has expressed interest in and appreciation to our business activity. This legitimate interest is pursued informing the data subject on our marketing and distance selling campaigns, advertising new products and services, presenting offers and promotions, so that the data subject can get to know these chances and decide, if wished, to place orders
4.	for the purpose referred to in point 4. “Data source and purposes of processing”, the legal basis is the data subject’s consent (art. 6, par. 1, letter a), GDPR)
5.	for the purpose referred to in point 5. “Data source and purposes of processing”, the legal basis is the “legitimate interest” of a third party (art. 6, par. 1, letter f), GDPR) to propose – through direct mailing – the purchase of products which may be appreciated by its market of reference  
6.	for the purpose referred to in point 6. “Data source and purposes of processing”, the legal basis is the data subject’s consent (art. 6, par. 1, letter a), GDPR).

Data processors, persons authorised to process personal data and autonomous data controllers
1.	Persons authorised to data processing are in charge of web services, contact centre, sales, marketing, information technology and data security
2.	Your personal data will be processed by processors, for services referred to in points 1., 3. e 4., “Data source and purposes of processing”
3.	To carry out activities necessary for web services requested by the user, personal data may be processed by third parties, autonomous controllers (e.g.: Internet Provider). As far as not here mentioned, these controllers are required to provide information pursuant to art. 13, GDPR for the processing they carry out. All processing carried out by these controllers concerns the purposes referred to in points 1. and 2., “Data source and purposes of processing”.  

Communication of personal data
Personal data may be communicated to third parties for their direct marketing purposes, according to the user’s choices: such third parties can operate in direct marketing field, especially, in distance selling (you can ask for the complete list by contacting the Controller at the address and e-mail as referred to in the paragraph “Data subjects’ rights”).

Criteria used to determine the period for which data will be stored
Depending on the purposes of processing, these are the criteria determined by the Controller for data storage:
1.	for the purposes referred to in point 1., “Data source and purposes of processing”, all data are stored for the period necessary to perform the registration to the website: data are stored as long as the user is registered and uses the services of interest. User’s data (and profile) will be cancelled if fraud or unlawful actions are detected. In this case, the Controller has the right to inform the competent authorities and communicate user’s data to them
2.	for the purposes referred to in point 2. “Data source and purposes of processing”, the period of data storage is determined by the single national and EU rules and laws governing legal obligations to which the Controller is subject
3.	for the purposes referred to in point 3. “Data source and purposes of processing”, personal data are stored in our filing system for the period necessary to keep in touch with the user  who has expressed interest in our business activity and to inform the user on it, so that Giordano can continue its own marketing and distance selling activities as long as the user is interested in our services and products, continuing to be registered. Of course, this period of storage is reduced if the interest to be in touch with Giordano fails: if the person loses this interest, just communicate the objection as described in the paragraph “Data subjects’ rights” and Giordano will implement organisational and technical measures so as not to contact the person any more
4.	for the purposes referred to in point 4., “Data source and purposes of processing”, personal data are stored in our filing system as long as the user’s profile is in line with the customised contacts created by interconnecting information at our disposal and, therefore, as long as Giordano continues its own distance selling and business activity with products, initiatives, offers, market researches and surveys which are considered interesting for the user because they meet characteristics and behaviour and are appreciated by the user. Data storage will cease, before the period here described, if the user objects to receiving such customised contacts and to being profiled for marketing purposes, exercising this right as explained in the paragraph “Data subjects’ rights” and Giordano will implement organisational and technical measures so as not to contact the person any more
5.	for the purposes referred to in point 5. and 6., “Data source and purposes of processing”, personal data are stored in our filing system according to data processing activities and purposes of processing carried out by Giordano as data controller and which are reported in the paragraph “Data source and purposes of processing”. Personal data will be communicated to the third parties mentioned in paragraph “Communication of personal data”.
After the periods stated above, identification data are transformed in anonymous data and used only for statistical reports and analysis. Identification data will be, therefore, destroyed, unless otherwise provided by supervisory authorities, law enforcement or judiciary.

Where data are processed, transfers of personal data to third Countries 
Even though data processing is usually carried out using the Controller’s server and/or third companies entrusted and appointed as data processors, within European Union. Personal data will be transferred to third Countries, mainly to perform customer services activities and telemarketing campaign, adopting the contractual clauses set forth in the Decision 5th February 2010 of the European Commission for the transfer of personal data to data processors, pursuant to article 46; GDPR and for the performance of a contract to which the data subject is party, in compliance with art. 49, par. 1, letter b), GDPR.
 
Data subjects’ rights
By writing to the Controller at the address Giordano Vini SpA via G. Cane 47bis/50 - 12055 Diano d’Alba (CN – Italy) or at e-mail privacy@giordanovini.it, you can exercise the right of access, to rectification, the right “to be forgotten” (erasure), to restriction of processing, to data portability and to object to the processing of your data on legitimate grounds and for marketing purposes – also limited to one or more contact means (e.g.: postal address, e-mail), phone) and profiling to the extent that it is related to such direct marketing. At any time, you can ask for the complete and updated list of processors and third parties to which data can be communicated.

How to lodge a complaint with a supervisory authority
The person has the right to lodge a complaint with a supervisory authority. In Italy the supervisory authority is the “Garante per la Protezione dei Dati Personali” – Piazza Venezia 11, 00187 Roma (Rome – RM – Italy) – www.garanteprivacy.it, and you can send your complaint at the e-mail protocollo@pec.gpdp.it, using the format which can be found at https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/4535524&zx=e0yn0riezmmw.

Data Protection Officer
Data subjects may contact our Data Protection Officer with regard to all issues related to processing of their personal data by sending an e-mail at dpo@giordanovini.it.

I have read the information ex art. 13, GDPR I:
Statement to web users regarding registration on the site to be provided under art. 13, Reg. UE 2016/679 (GDPR)
