Users may also contact the Data Protection Officer (RPD or DPO) of the Data Controller, whose contact details are as follows: Mr. Lapo Curini Galletti, of the company Shibumi S.r.l. - e-mail: firstname.lastname@example.org.
The personal data of the Users will be processed lawfully by the Data Controller pursuant to Article 6 of the Regulation for the following processing purposes:
c) administrative and accounting purposes, or to perform organizational, administrative, financial and accounting activities, such as internal organizational activities and activities functional to the fulfilment of contractual and pre-contractual obligations;
d) legal obligations, or to fulfil obligations provided by the law, an authority, a regulation or European legislation.
The Data Controller will process the personal data of Users using manual and IT tools, with logic strictly related to the purposes themselves and, in any case, in order to guarantee the security and confidentiality of the data.
The personal data of Users will be retained for the time strictly necessary to carry out the main purposes explained in paragraph 1 above or, in any case, as necessary for the protection in civil law of the interests of both the Users and the Data Controller.
The employees and/or collaborators of the Data Controller who are in charge of carrying out Website maintenance may become aware of the personal data of the Users. These subjects, who have been instructed by the Data Controller accordingly to article 29 of the Regulation, will process the User's data exclusively for the purposes indicated in this policy and in compliance with the provisions of the Applicable Law.
The personal data of the Users may also be disclosed to third parties who may process personal data on behalf of the Data Controller as "External Processors", such as, for example, IT and logistic service providers functional to the operation of the Website, outsourcing or cloud computing service providers, professionals and consultants.
Users have the right to obtain a list of any data controllers appointed by the Data Controller, making a request to the Data Controller in the manner indicated in paragraph 4 below.
Users may exercise their rights granted by the Applicable Law by contacting the Data Controller as follows:
Pursuant to Applicable Regulations, the Data Controller informs that Users have the right to obtain indication (i) of the origin of personal data; (ii) the purposes and methods of the processing; (iii) the logic applied in the event of processing carried out with the aid of electronic instruments; (iv) of the identification details of the data controller and processors; (v) the subjects or categories of subjects to whom the personal data may be communicated or who may come to aware of them as processors or agents.
Furthermore, Users have the right to obtain:
a) Access, updating, rectification, or, when interested, integration of data;
b) The cancellation, transformation into anonymous form or the blockage of data processed in breach of the law, including data that does not need to be stored in relation to the purposes for which the data was collected or subsequently processed;
c) Certification to the effect that notification has been supplied of operations as per letters a) and b), as regards their content, to those to whom the data was communicated or disseminated, except for the case where notification proves impossible or requires the use of means clearly disproportionate to the right being protected.
Moreover, the Users have:
a) The right to revoke consent at any time, if the processing is based on their consent;
b) The right to data portability (the right to receive all personal data concerning them in a structured format, commonly used and readable by automatic device), the right to limit processing of personal data and right of deletion (“the right to be forgotten”);
c) The right to oppose to:
d) If it is deemed that the processing concerning their personal data violates the Regulation, the right to lodge a complaint with a Supervisory authority (in the Member State in which they usually reside, in the one in which they work or in the one in which the alleged violation has occurred). The Italian Supervisory Authority is the Data Protection Authority, with registered offices in Piazza Venezia No. 11, 00187 – Rome (http://www.garanteprivacy.it/).***