Processing of Personal Data

Communication in reference to Art. 13 of EU Regulation 2016/679 and related applicable regulations

In accordance with art. 13 of EU Regulation 2016/679 (the “Regulation”), as well as the applicable privacy regulations, Kappa S.r.l. with sole shareholder (hereinafter “Company” or “Controller”), informs you that your personal data (hereinafter the “Personal Data”) will be processed according to current regulations and in full respect of the principles of fairness, legitimacy, transparency and safeguarding of privacy thereby envisaged.

Type of data processed

The Personal Data subject to processing are:

• personal and contact data (e.g. name, surname, residential address, telephone number, e-mail);
• data provided directly by you in relation to the Controller's e-commerce services;
• data in any case acquired at the time of on-line purchase of products distinguished by the brands for which the Company is the exclusive licensee for Italy;
• any other common data acquired as instrumental to the establishment and execution of the contractual relationship with the Controller.

Purpose of the processing and nature of the provision of data

Due to the existing relationship with the Company, the Personal Data will be processed with the support of computerised and/or paper means or in automated form and the processing of will be aimed at:

a)  the fulfillment of legal obligations, such as, by way of example but not limited to, tax, accounting and administrative obligations; the provision of personal data for these purposes is a legal obligation. Failure to provide the data will prevent the Company from carrying out the activity requested by you which requires the fulfillment of a legal obligation by the Company itself;

1. b)  the fulfilment of the obligations deriving and connected to the contract, such as, by way of example but not limited to, the execution of transport services and after-sales assistance to customers; the provision of personal data for these purposes is a contractual obligation. Failure to provide the data will result in the impossibility for the Company to execute the contract;
2. c)   performance of direct marketing activities, such as the sending - also by e-mail, and SMS - of advertising material and communications with promotional content in relation to products or services provided and / or promoted by the Data Controller or by his business partners, including gifts; the provision of data for this purpose is optional. The refusal to give the related consent to the processing involves the impossibility for the Company to follow up on the activities indicated above;
3. d)  processing of your personal data to place you in the relevant target group (so-called profiling) and to be able to send you personalised commercial and promotional information by e-mail, fax and telephone. The provision of data for this purpose is optional. Refusal to give consent to the processing of your data will make it impossible for the Company to carry out the activities indicated above.

Legal Basis

The legal basis for Personal Data processing is:

•  for the purposes referred to in letter a), the compliance with legal obligations
•  for the purposes referred to in letter b), the established contractual relationship
• for the purposes referred to in letters c) and d), your consent. 

The provision of Personal Data is compulsory (as a legal or contractual obligation) or sometimes optional. Any refusal by the data subject to provide Personal Data may make it impossible for the Company itself, depending on the case, to comply with applicable legal requirements, specific requests received from the authorities, obligations arising from contracts, or to pursue its own legitimate interest, sometimes without prejudice to the activity that the Company intends to pursue (e.g. management of any litigation).

Where the provision of Personal Data is based on consent, this is always optional. Failure to provide consent will not in any case affect the contractual relationship established.

Please also note that your Personal Data will be communicated and processed within the organisation by personnel duly appointed and instructed by the Data Controller.

Data processing methods

Personal Data will be processed using paper-based and digital tools and implementing appropriate safety measures to protect the safety and privacy of your personal data, and regarding profiling, to safeguard your rights, freedom, legitimate interests, and in particular to safeguard your right to obtain human intervention on behalf of the Controller, to express your opinion and to challenge any decision.

Transfer and Personal Data Recipients

The data gathered will be used exclusively within the aims listed above on the Italian territory. The Controller does not intend to transfer Personal Data outside the EU.

However, should the need arise in the future to transfer Personal Data outside the territory of the EEA, the transfer will only take place by adopting the safeguard mechanisms prescribed by the Regulation, subject to suitable notice being provided to the data subject.

Data processing will be carried out by Controller employees and/or subjects identified and authorized by the Controller to process the data.

The Personal Data provided will be not distributed or made public.

The Personal Data may be communicated to:

1. subjects granted access by law or by special orders by the authorities, as well as
2. subjects, including third parties, the Controller employs to carry out instrumental and/or accessory activities to manage online purchases, among which, by way of example but not limited to, companies charged with the management of the deliveries of the purchased products,

With reference to the Personal Data communicated to them, the recipients belonging to the above categories may act, depending on the case, as data processors (and in this case they will receive appropriate instructions from the Controller) or as autonomous data controllers.
 
The Personal Data will be processed by employees of the data Controller and / or by persons specifically identified by the Data Controller as authorized processing personnel, instructed on the modalities and purpose of the processing.

Data retention

In accordance with the principles of proportionality and necessity, the Personal Data will not be stored for periods longer than those essential to achieve the aims listed above, except for legal obligations.

Rights of concerned parties

We hereby inform you that the data subject is entitled to the following rights:

Right of access: (art. 15 of the Regulation)	meaning the confirmation as to whether personal data concerning you are being processed, and, where that the case, access to the personal data and the information in relation to the purpose of the processing, the categories of personal data concerned, the recipients or categories of recipient to whom the personal data have been or will be disclosed.
Right to rectification: (art. 16 of the Regulation)	(i) without undue delay, rectification of inaccurate personal data concerning you and (ii) have incomplete personal data completed.
Right to erasure («right to be forgotten»): (art. 17 of the Regulation)	erasure of personal data concerning you without undue delay (the Controller shall have the obligation to erase personal data without undue delay where the cases provided for in article 17 of the Regulation apply).
Right to restriction of processing: (art. 18 of the Regulation)	restriction if processing where the cases provided for in article 18 of the Regulation apply.
Right to data portability: (art. 20 of the Regulation)	receive on a structured format, of common use and which can be read by automatic device, the personal data concerning you and in our possession; right to transmit those data to another controller without hindrance from the controller to which you have provided the personal data, where the cases provided for in article 20 of the Regulation apply.
Right to object to processing executed pursuant to article 6 (1), points (e) or (f): (art. 21 of the Regulation)	object, at any time, on grounds relating to your particular situation, to processing of personal data concerning you which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions.

You also have the right to lodge a complaint with the Garante per la Protezione dei dati personali (Data Protection Authority) if you consider that the processing of your personal data violates the requirements of EU Regulation No. 2016/679.

Finally, we inform you that you have the right to withdraw at any time any consent you might have granted to specific non mandatory activities, without prejudice to the lawfulness of the processing carried out prior to the withdraw.

These rights may be exerted via written communication to be sent to: customer@kappa.com

Processing Controller

The processing controller is Kappa S.r.l. with sole shareholder, located in Turin, Largo Maurizio Vitale 1, 10152Italy.

A list of external data processors has been published on the Controller’s website.

Data Protection Officer (“D.P.O.”)

It is possible to contact the ìdata protection officer of the Company at the following email address: dpo@seefree.it