INFORMATION NOTICE PURSUANT TO ART. 13 OF THE EU REGULATION N. 2016/679

B810 Srl , (Tax code and VAT number 03378920361) (infra “B810”), in the person of its pro tempore legal representative, with registered office in Reggio Emilia, via E. Lazzaretti, 2/1, DIGICOM Srl , (Tax code and VAT number: 03488160122) (hereinafter “DIGICOM”), in the person of its pro tempore legal representative, with registered office in Legnano (MI), viale Cadorna, 95, and MC REGEM Srl , (Tax code and VAT number: 02891380350) (hereinafter “MC REGEM”), in the person of its pro tempore legal representative, with registered office in Reggio Emilia, via G. Gutenberg, 3, as co-Controllers of the treatment pursuant to art. 4 n. 7) and 26 of EU Regulation no. 2016/679 (GDPR), inform you that, pursuant to art. 13 of the GDPR, your personal data described in the following art. 1 will be processed for the execution of the processing purposes described in the following art. 2.

B810, DIGICOM and MC REGEM can be jointly referred to as “co-data controllers”, and they are part of the same business group pursuant to art. 4 n. 19) of the GDPR: in this regard, they specify that the essential content of the related joint ownership agreement pursuant to art. 26 paragraph 2) of the GDPR can be easily consulted by you by sending a specific request to one of the contact details illustrated in the following art. 7.

In addition to this document, the co-Data Controllers also send you to read the GCS, GCUs and the Cookie Policy.

1. Category of personal data being processed.

1.1. The co-Data Controllers collect and process, in order to pursue the specific processing purposes described in art. 2 (in compliance with the minimization principle pursuant to art.5 paragraph 1) letter c) of the GDPR), your personal data pursuant to art. 4 n. 1) of the so-called GDPR. identifiers (e.g. name; surname; tax code; residence address / domicile / residence), cd. financial / banking (eg. credit / debit card number) where necessary and appropriate and your browsing data (eg IP address), in the event that you qualify as a “consumer user” as better described in the GCS ( below “personal data”); on the contrary, in the event that you qualify as a “professional user” as better described in the GCS, the co-Data Controllers collect and process, in order to pursue the specific processing purposes described in art. 2 (in compliance with the minimization principle pursuant to art.5 paragraph 1) letter c) of the GDPR), your non-personal data pursuant to art. 3 n. 1) of the EU Regulation no. 2018/1807 (eg company name; VAT number; registered office) (hereinafter “non-personal data”) as well as, where necessary and appropriate, some of your personal data.

In detail, the co-Data Controllers specify that your personal data cd. identification data, your browsing data and your non-personal data (in the case of a professional user) may be stored where necessary and appropriate, while your financial / banking data will not be subject to any storage by the co-Data Controllers .

2. Purpose of the processing and related legal basis.

2.1. Your personal data (and / or your non-personal data, in the case of a professional user) are processed by the co-Data Controllers, for the execution of the following (macro) processing purposes:

1. Complete and effective execution of a pre-contractual measure and / or a purchase order (and consequent conclusion of the related purchase contract better described in the GCS), including the execution of the preliminary obligations (e.g. registration on the website in question, and consequent creation of your personal account) and the execution of the consequent legal (e.g. legal guarantee; fraud), fiscal, administrative, logistical and customer care (e.g. complaint management or return procedure) obligations connected to the completion of the related contract of purchase.

In compliance with art. 13 paragraph 2) letter e) of the GDPR, the co-Data Controllers inform you that any failure to communicate (even partial) your personal data (and / or your non-personal data, in the case of a professional user) requested ( and indicated, clearly and unambiguously, as indispensable and mandatory, for example by affixing a special distinctive sign, such as an asterisk) for the execution of the (macro) processing purpose described in art. 2.1. letter a) determines the impossibility, for the co-Controllers of the treatment, to execute – in a complete, correct and effective way – a pre-contractual measure, a purchase order (and consequent relative purchase contract) as well as the preliminary or consequent fulfilments of various nature connected to this.

In this regard, the co-Data Controllers specify that the legal basis of the processing purpose described in art. 2.1. letter a) can be found in art. 6 paragraph 1) letter b) of the GDPR regarding, specifically, the execution of a pre-contractual measure or a purchase order (and related purchase contract) including the execution of the preliminaries and any obligations, in art. 6 paragraph 1) letters c) and f) of the GDPR as regards, specifically, the execution of the consequent legal, fiscal, administrative, logistical and customer care obligations.

2.2. Your personal data are processed by the co-Data Controllers for the execution of the following processing purpose, applicable only to the consumer user as established by art. 130 paragraph 4) of the amended Legislative Decree n. 196/2003 (Privacy Code):

1. Sending commercial / promotional / advertising / marketing communications, regarding a product or service similar to that purchased by the consumer user through the website in question, to be carried out by email or by paper mail.

In compliance with art. 13 paragraph 2) letter b) of the GDPR, the co-controllers of the processing inform you of the possibility of opposing, pursuant to art. 21 of the GDPR, at any time pursuant to art. 130 paragraph 4) of the Privacy Code for the processing purposes described in art. 2.2. letter b), through the use of the contact details illustrated in art. 7.

In this regard, the co-Data Controllers specify that the legal basis of the processing purpose described in art. 2.2. letter b) is found in art. 130 paragraph 4) of the Privacy Code (specified, as regards the use of paper mail, by the Provision of 19.6.2008 signed by the Italian Privacy Guarantor), and in art. 6 paragraph 1) letter f) of the GDPR.

2.3. Your personal data (and / or your non-personal data, in the case of a professional user) are processed by the co-Data Controllers, for the execution of the following processing purposes, after obtaining the specific, informed, free and unambiguous consent from the consumer user and / or from the professional user:

1. Sending commercial / promotional / advertising / marketing communications (including market research), to be carried out using automated / electronic / telematic methods (e.g. email; mobile app; social page; newsletter) or through non-automated / traditional methods (e.g. paper mail).

In compliance with art. 13 paragraph 2) letter c) of the GDPR, the co-Data Controllers inform you of the right to revoke, at any time, any consent given for the processing purposes described in art. 2.3. letter c), without this event being able, however, to prejudice the lawfulness of the processing based on the consent provided before the revocation.

In this regard, the co-Data Controllers specify that the legal basis of the processing purpose described in art. 2.3. letter c) is found in art. 6 paragraph 1) letter a) of the GDPR, in art. 130 paragraphs 1) and 2) of the Privacy Code, and in art. 8 of Legislative Decree n. 70 of 9.4.2003 (Electronic Commerce Code).

3. Retention period.

3.1. In compliance with art. 13 paragraph 2) letter a) of the GDPR, the co-Data Controllers communicate the following retention periods, at the end of which your personal data (and / or your non-personal data, in the case of a professional user) will be subject to cancellation, destruction or anonymization: (i) for the execution of the (macro) processing purpose referred to in art. 2.1. letter a): term of n. 10 years pursuant to art. 2220 and 2946 of the Italian Civil Code, starting from the definitive conclusion of the pre-contractual measure or from the definitive conclusion of the purchase order and related purchase contract, a term that may be extended in order to fulfill a regulatory obligation (even if it has arisen) or to assert or defend a right , even in court; (ii) for the execution of the processing purpose referred to in art. 2.2. letter b): as long as you (in your capacity as consumer user only) communicate to the co-Data Controllers, even separately, your opposition to this treatment; (iii) for the execution of the processing purpose referred to in art. 2.3. letter c): as long as you communicate to the co-Data Controllers, even separately, your revocation of the consent previously provided for the execution of the processing purpose in question.

4. Recipients.

4.1. In compliance with art. 13 paragraph 1) letter e) of the GDPR, the co-controllers specify that your personal data (and / or your non-personal data, in the case of a professional user) may be communicated, where appropriate and necessary, to a or more recipients pursuant to art. 4 n. 9) of the GDPR, thus identified, in general, by category: (i) for the execution of the (macro) processing purpose referred to in art. 2.1. letter a): authorized parties pursuant to art. 4 n. 10), 29 and 32 paragraph 4) of the GDPR to the processing by each of the co-Data Controllers (hereinafter “authorized subjects”); consultants or companies of various kinds that provide, in any case, services and / or services (including professional) connected, even indirectly, to the fulfillment of the purpose in question (eg IT company; legal and / or tax consultant); (ii) for the execution of the processing purpose referred to in art. 2.2. letter b): subjects authorized to process; consultants or companies of various kinds that provide, in any case, services and / or performances (including professional) connected, even indirectly, to the fulfillment of the purpose in question (eg marketing companies); (iii) for the execution of the processing purpose referred to in art. 2.3. letter c): subjects authorized to process; consultants or companies of various kinds that provide, in any case, services and / or performances (including professional) connected, even indirectly, to the fulfillment of the purpose in question (eg marketing companies).

4.2. The co-Data Controllers specify that your personal data (and / or your non-personal data) will not be disclosed.

5. Transfer.

5.1. The co-Data Controllers specify that your personal data (and / or your non-personal data) are stored in automated, partially automated or non-automated archives belonging to or attributable, even indirectly, to the co-Controllers. of the treatment, and located within the European Economic Area (EEA).

6. Rights of the interested party.

6.1. In relation only to your personal data, the co-controllers of the processing inform you of the right to exercise the following rights that may be subject to the limitations provided for by art. 2 undecies and 2 duodecies of the Privacy Code: right of access ex art. 15 of the GDPR: the right to obtain confirmation as to whether or not personal data is being processed, as well as the information referred to in art. 15 of the GDPR (e.g. processing purposes, retention period); right of rectification ex art. 16 of the GDPR: right to correct, update or integrate personal data; right to cancellation ex art. 17 of the GDPR: right to obtain the cancellation or destruction or anonymization of personal data, however, where the conditions listed in the same article are met; right to limit the processing ex art. 18 of the GDPR: right with a markedly precautionary connotation, aimed at obtaining the limitation of treatment where the hypotheses governed by the same art. 18; right to portability of the data pursuant to art. 20 of the GDPR: right to obtain personal data, provided to the co-Data Controllers, in a structured format, commonly used and readable by an automatic system (and, where required, to transmit them, directly, to another Data Controller of the processing), where the specific conditions indicated in the same article exist (eg legal basis of consent and / or execution of a contract; personal data provided by the interested party); right to object ex art. 21 of the GDPR: right to obtain the permanent cessation of a specific processing of personal data; right to lodge a complaint to the Supervisory Authority (i.e., the Italian Privacy Guarantor) pursuant to art. 77 of the GDPR: right to lodge a complaint where it is believed that the processing under analysis violates national and community legislation on the protection of personal data. 

6.2. In addition to the rights described in the previous art. 6.1., The co-Data Controllers specify that, in relation only to your personal data, there is, where possible and conferring, the right to exercise, on the one hand, the (sub) right provided for by art. 19 of the GDPR (“The data controller communicates to each of the recipients to whom the personal data have been transmitted any corrections or cancellations or limitations of the processing carried out pursuant to Article 16, Article 17, paragraph 1, and Article 18, unless this proves impossible or involves a disproportionate effort. The data controller communicates these recipients to the interested party if the interested party requests it “), to be considered connected and connected to the exercise of one or more rights regulated by art. 16, 17 and 18 of the GDPR; on the other hand, the co-data controllers specify that, in relation only to your personal data, there is, where possible and conferring, the right to exercise the right provided for by art. 22 paragraph 1) of the GDPR (“The interested party has the right not to be subjected to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or which significantly affects his person”) , subject to the exceptions provided for in paragraph 2 below).

6.3. In compliance with art. 12 paragraph 1) of the GDPR, the co-controllers undertake to provide the communications referred to in Articles. from 15 to 22 and 34 of the GDPR in a concise, transparent, intelligible, easily accessible form and in simple and clear language: this information will be provided in writing or by other possibly electronic means or, at the request of the interested party, will be provided orally provided that the identity of the latter is proven by other means.

6.4. In compliance with art. 12 paragraph 3) of the GDPR, the co-Data Controllers inform you that they undertake to provide information relating to the action taken regarding a request pursuant to art. from 15 to 22 of the GDPR without undue delay and, in any case, at the latest within one month of receipt of the request; this term can be extended by no. 2 months if necessary, taking into account the complexity and number of requests (in this case, the co-Data Controllers undertake to inform of this extension and the reasons for the delay, within one month of receipt of the request).

6.5. The aforementioned rights (except for the right pursuant to art.77 of the GDPR) can be exercised through the contact details illustrated in the following art. 7. 

7. Contact details.

7.1. The co-Data Controllers can be contacted at one of the following addresses, to be considered alternative and equivalent: info@b810group.it ; privacy@digicom.it ; mcregem@legalmail.it

7.2. The Data Protection Officer (DPO) pursuant to art. 37 of the GDPR, appointed by the co-Data Controllers, can be contacted at one of the following addresses, to be considered alternative and equivalent: privacydpo810@baldiandpartners.it ; privacydpodigicom@baldiandpartners.it ; dpomcregem@baldiandpartners.it

Reggio Emilia / Legnano, 20.10.2021 (date of last update)

B810 Srl , DIGICOM Srl and MC REGEM Srl

(in the person of their respective pro tempore legal representatives)