This document, drawn up in accordance with article 13 of Regulation (EU) 679/2016, describes how this website “zanardo.com” collects and processes the personal information of its website users (hereinafter “website”). These parties are identified jointly as “data subjects” or “users” in this policy statement.
The activities summarised herein are subject to Regulation (EU) 679/2016 regarding the protection of personal data (hereinafter “Regulation”).
The Data Controller (hereinafter “controller” is Zanardo S.p.A., with registered office in Via Trevisani nel Mondo 8, 31058 – Susegana (TV), VAT reg. no. 03217580269.
Controller contact details: info@zanardo.com
The controller can collect the following data to enable users to order the products on offer:
Information provided by the users
User profile: the user will be asked to open an account to access the website services as a registered user. When this account is being created or amended, certain information can be collected such as name, surname, email address and access username and password.
Content sent voluntarily by the users: information that the data subjects send when they get in touch with our assistance contact details or when they contact the controller in another way can be collected.
Data relating to the orders: when the users order a product, the data relating to the order made and product chosen may be acquired.
Contact details for promotional communications: the email address of users will be collected and stored if they subscribe to the newsletter service.
Information created when using the services
Information on use: information on how users interact with the website may be collected. There is more information available in the Cookie Policy.
The information collected is used for the following purposes:
Services and functionality
The controller uses the information collected to provide, customise, maintain and improve its products. In order to pursue this purpose, a set of activities are carried out in order to:
• create and update the accounts;
• enable the users to order the products made available through the website;
• process the orders;
• obtain anonymous statistical information on the use of the website through the software SAAS Lead Champion Discover, for lead generation purposes to automatically identify the names of the companies and entities who visit the website
• carry out the internal operations needed to maintain the website, including to resolve problems;
• implement normal administrative and accounting procedures;
• manage any issues of promotions and coupons;
• respond to customer requests.
Customer assistance
The controller also uses the information collected to ensure efficient customer assistance or to examine and resolve any problematic issues reported by users.
Legal procedures and requirements
The information collected can also be used to examine or manage requests or disputes related to the use of the services provided, or to discharge specific legal obligations required under prevailing laws.
Promotional campaigns
The information collected can be used to propose or highlight offers relating to its products by sending periodic newsletters.
In order to allow the operations needed to supply its products, the information collected may be shared:
With the service suppliers
The controller may share the information with suppliers, consultants or other service suppliers or corporate partners. This category includes, inter alia:
• suppliers of storage space on the cloud;
• suppliers who help the controller to develop and optimise website security;
• consultants, lawyers, accountants and other providers of professional services;
• persons authorised by the data controller.
For legal reasons or in the event of disputes
The controller can share information, if necessary, in accordance with applicable laws, regulations, operating agreements, legal proceedings or applicable government requests or in cases where the disclosure of said information is necessary for reasons of security or other similar reasons.
Data can also be shared with the security forces and legal authorities.
With reference to what was expressed in this section, the updated list of data processors can be consulted at the registered office of the controller, or a copy can be requested through the contact information indicated under section 1 of this document.
The personal data of the data subject may be subject to transfer outside the European Union. The Data Controller guarantees that said transfer of the data outside the EU could be based on a decision of adequacy, on the Standard Contractual Clauses approved by the European Commission or on another suitable legal basis that, in any case, ensures compliance with the Regulation.
The website uses the information from the client’s profile to offer its services and retains it as long as the account is active.
The controller retains the information, including the information on transactions, for 10 years in accordance with regulatory and tax obligations and other requirements in effect in the country in which it operates. At the end of the period mentioned above, or if said information is no longer necessary for the purposes set out above, the controller will adopt the measures necessary to impede access or use for any reason.
Data subjects can remove their accounts and following said request, the controller will eliminate the information that it is not obliged to retain, making any data that cannot be deleted anonymous if possible.
The contacts needed to send promotional information will be retained for a maximum of 24 months.
The personal information collected is processed on the basis of one or more legal bases specified in the Regulation:
The data processing is necessary to provide the services requested by the data subjects:
The controller must collect and use the following information in order to offer its services:
• profile information needed for the creation and management of the account and to enable orders to be filled;
• information relating to the orders;
• information on use, needed for the management, optimisation and improvement of the services provided.
The transfer and use of this data is a necessary requirement to use the services offered.
The processing of data is needed to fulfil the contractual obligations or pre-contractual measures in favour of the data subject.
The controller will have to collect, use and process the following information to meet a request made by a website user:
• contact information needed to respond to the requests made by the user;
The transfer and use of this data is a necessary requirement to use the services requested.
The data processing is necessary for the legitimate interests of the controller
The controller collects and uses the personal information to the extent necessary for its legitimate interests. This information is needed:
• to carry out lead generation with reference to companies or entities that visit the website;
• to enforce a right during legal proceedings;
• to provide assistance to the user;
• to improve services and develop new ones;
• for research and analysis purposes. The use trend analyses are included for example, to improve the user experience, increase security and protection of the website.
The data processing is necessary to fulfil legal obligations
The controller may be obliged by the legal system in effect to collect, process, disclose and retain the personal data collected.
The controller may also share information with the security forces and the legal authorities, or following requests by third parties within the scope of legal proceedings.
The data processing is subject to consent by the data subject
The user will have to express his/her/their specific and express consent to use each of the following services:
• receipt of promotional newsletters.
Soft Spam
The controller notes that in accordance with article 130 of the Privacy Code (Legislative Decree 196/2003 as amended) it may use the email contact or address of customers to send promotional communications by email or traditional mail with respect to the publication of products and/or similar services to those previously acquired. Express consent is not required by the user for that purpose, but the user may, at any time, exercise his/her/their right to object to this type of processing.
The data submitted through Lead Champion Discover are the public data that refer to economic entities, and prior consent is not required since the law wishes to protect transparency in the performance of economic activities.
More specifically, Lead Champion Discover complies with the Regulation since:
• it does not track personal data that could lead to a person, but only to economic entities (companies). More specifically, the IP addresses are not made available on Lead Champion Discover in a way that would prevent any possible use of personal data
• all the data are kept within the European Union, more specifically in data centres located in Italy and Ireland
• each user may access the opt-out link available on the Lead Champion website and block the tracking by the service. This opt-out means that the tracking by Lead Champion Discover can be avoided at the level of single user - therefore the data of the economic entity may be tracked for other users who belong to the same organisation.
• company data do not apply in accordance with the Regulation which aims to protect personal data. Therefore, most of the Lead Champion solution and its characteristics are irrelevant with respect to the Regulation.
The data subject has the right to ask the controller, at any time, for access to his/her/their Personal Data, their rectification or erasure, or to object to their processing; he/she/they has/have the right to request to restrict the processing in the cases provided for under article 18 of the Regulation, and to obtain the data that pertain to him/her/them in a structured format, in common use and machine-readable in the cases provided for under article 20 of the Regulation.
In order to exercise the rights set out above, or for any question or clarification on this privacy policy, the contacts provided in this policy statement can be used.
The controller will promptly provide a suitable response within one month. In particularly complex cases, the deadline for the response, in accordance with the Regulation, may be three months. In any case, the controller will inform the data subject within one month from the request, including to notify the user of rejection in the cases specifically contemplated under prevailing laws.
Pursuant to article 77 of Regulation (EU) 679/2016, if a data subject believes his/her/their rights have been infringed, the data subject may also contact the Data Protection Supervisory Authority and the ordinary legal authorities.
The controller may occasionally update this policy statement.
To the extent permitted by prevailing law, by using the services of the website the proposed updates will be considered to have been implicitly accepted after said notification.
The controller encourages the data subject to periodically refer to this document in order to remain updated on its data protection procedures.
Download the product catalogue and all information material available.
Discover
