Pursuant to the current regulations on personal data protection, "C. Frascogna S.r.l.", VAT no. P.IVA 06932191213, with registered office in Naples, via Miano n. 112, postal code 80145, in its capacity as data controller (hereinafter also referred to as "Controller"), wishes to provide users of the website www.frascognashop.it (hereinafter referred to as "site") the information regarding the processing of personal data.
The information is provided only for the site and not for other web spaces accessible through any links present on the site, which have their own personal data protection policies that users are encouraged to consult by accessing the respective websites.
The site allows payments by credit card through the PayPal gateway, which, when used through the site, may collect and process user data according to its privacy policies, even from locations outside the European Union. Therefore, before interacting with this web platform, users are encouraged to consult the data processing information available on it and only then decide whether to use it through the site.
The services offered through the site are exclusively reserved for individuals who have reached the age of eighteen. The data controller will ensure the immediate deletion of all personal data inadvertently collected in relation to individuals who have not reached the age of eighteen.
The site uses cookies, including third-party cookies, to provide users with a better browsing experience. All information regarding the use of cookies and how to select or deselect them and possibly deny consent to the installation of any cookie can be found in the specific cookie usage policy available here.
1) Categories of data subject to processing
1.1. Navigation data
The computer systems that ensure the operation of the site detect certain so-called "navigation" data, such as: IP addresses, domain names of the computers used by users connecting to the site, URIs of the requested resources, parameters related to the user's computer system.
The provision of this data is automatic and mandatory for browsing the site.
This data is not collected to be referred to identified users, but it could allow for user identification if associated with other data held by third parties.
The Data Controller has no possibility of independently identifying the user through the sole navigation data and guarantees that this data will be used solely for the purpose of obtaining statistical information on the use of the site and will be deleted as soon as the activities for which they were collected are completed.
The data may be used for the ascertainment of responsibility in the event that computer crimes are committed against the site.
1.2. Data voluntarily provided by the user
The personal data provided by users at the time of completing the information request form belong to the category of common data and do not include sensitive, health, genetic, biometric, judicial data, or data referred to in arts. 9 and 10 of EU Regulation no. 2016/679, as the processing of such last categories of data is not necessary for pursuing the purposes sought by the Data Controller.
In any case, only personal data strictly necessary for pursuing specific and legitimate purposes will be processed, with respect to which the processing will always be relevant and never excessive.
2) Source from which the personal data originate
The so-called "navigation" data referred to in the previous art. 1.1 are automatically acquired by the software procedures responsible for the operation of the site.
The personal data referred to in the previous art. 1.2 are provided by users of the site through the completion of specific electronic forms present on the pages of the aforementioned site.
3) Purposes of processing
Unless specified in the previous art. 1.1 regarding the so-called "navigation" data, the personal data provided by users of the site may be processed:
a) to register on the site and enjoy the services offered by the Data Controller;
b) to complete purchases through the site and fulfill the related contractual obligations;
c) for carrying out the necessary accounting/administrative activities related to the purposes referred to in letters a) and b);
d) for the fulfillment of obligations related to the purposes referred to in letters a) and b) as provided by law and regulations of the European Union;
e) for commercial, advertising, promotional, and marketing purposes in a broad sense, which involve processing:
e. 1) for sending communications of information regarding new product and service offers, of a commercial nature and/or commercial solicitation (Newsletter) by the Data Controller;
e. 2) to carry out sales activities of services of the Data Controller;
e. 3) for sending unsolicited commercial communications, immediately identifiable as such and containing the indication that the recipient can oppose the receipt of further communications of this kind.
4) Expression of consent
Consent to the processing of personal data, where required, is given by the data subject through the selection of the appropriate fields on the data collection form.
5) Consequences of the failure to communicate personal data
The communication of personal data requested in the various information collection forms present on the site and marked with an asterisk (*), which are defined as mandatory data, while being left to the user's free will, is necessary to achieve the specific purposes pursued by the Data Controller related to the processing of this information.
Consequently, the failure to communicate mandatory personal data will prevent achieving the main purpose for which they are requested.
In particular, the communication of personal data marked with an asterisk (*) and requested in the information form of the "Checkout" section is necessary for the conclusion of the sales contract and the delivery of the product the user wishes to purchase.
Therefore, the failure to communicate this data will prevent the purchase of products through the site as well as the conclusion of any agreement with the Data Controller.
Even without providing mandatory data, the user can still continue to browse the site.
The communication of additional data beyond those marked with an asterisk, which are defined as optional, is left to the user's discretion; consequently, the failure to communicate optional data will not produce any consequences.
Similarly, consent to the processing of personal data for marketing purposes as per art. 3 letter e) of the notice is purely optional.
Therefore, the failure to provide and consent to the related processing will not have any consequences for the user, except that they will not receive the promotional and commercial communications indicated in art. 3 letter e).
The Data Controller wishes to inform the user that by consenting to the processing of personal data for commercial, advertising, promotional, and marketing purposes as per art. 3 letter d), the user authorizes the processing of their data:
- both through "traditional" methods, such as: phone calls with an operator and contact through other non-electronic means or not supported by automatic or telematic procedures, and through automated calls and similar means such as: SMS and similar, systems supported by automatic, electronic, or telematic procedures, without an operator;
- with reference to all the purposes indicated in art. 3 letter e), that is, both to those indicated in letter e.1) and to those indicated in letter e.2), as well as to those indicated in letter e.3).
In any case, the user has the right to request at any time to limit the processing of personal data for the purposes referred to in art. 3 letter e) to only some of the methods explicitly stated above (for example, only through "traditional" means) or to some of the types of processing indicated in letters e.1), e.2), and e.3) (for example, only for sending newsletters).
6) Legal basis for processing
The legal basis for the processing of data for the purposes referred to in art. 3 letters a) and b) consists in the necessity to carry out specific activities requested by the user, in the necessity to conclude contracts with the user and fulfill the related obligations. With reference to these purposes, although not mandatory, the Data Controller also requests the user's consent.
The legal basis for the processing of personal data related to the purposes referred to in art. 3 letters c) and d) consists, respectively, in the necessity to fulfill the contractual obligations assumed towards the user and in the fulfillment of legal obligations.
The legal basis for the processing of personal data related to the purposes referred to in art. 3 letter e) consists exclusively of the prior, free, specific, optional, and informed consent to the processing for the aforementioned purpose.
The legal basis for the processing of navigation data consists of the legitimate interest of the Data Controller in the necessity of the site's operation.
7) Processing methods
The personal data provided by users of the site will be processed at the offices of the Data Controller, or in other locations where the parties involved in the processing operate, through electronic and/or mechanical and analog methods for the time strictly necessary to achieve the purposes for which they were collected and in any case not exceeding the limits indicated in this notice, in full compliance with the purposes pursued by the Data Controller and in accordance with the current regulations on privacy.
Specific security measures are observed to prevent data loss, unlawful or incorrect use of the same, as well as unauthorized access.
8) Communication of personal data for the fulfillment of contractual obligations or legal obligations
In compliance with current privacy regulations, the user's personal data may be communicated to third parties for whom communication is necessary for the pursuit of the purposes referred to in Article 3 letters a), b), and c) without the need to obtain separate consent.
Pursuant to Article 13 letter e) of EU Regulation No. 216/679, it is specified that the personal data of the Client may be communicated to the following categories:
- employees and collaborators of the Data Controller, appointed as Data Processors and specifically trained in accordance with Article 29 of EU Regulation No. 2016/679;
- individuals possibly appointed as Data Processors or data protection officers;
- third parties in the following categories: technical studies, individuals and/or companies that offer digital communication services, including hosting services, website publishing services, software design and development, or that operate as providers of IT and logistical services necessary for the operation of the site, as well as individuals and/or companies that provide shipping services.
- Public Authority or to any other third party if required by law.
9) Communication of personal data for the pursuit of promotional and marketing purposes in a broad sense
The Data Controller will not communicate the user's data to third parties for promotional or marketing purposes as defined in Article 3 letter e).
10) Further cases of communication of personal data
For the sole purpose of satisfying the legitimate interest of the Data Controller in protecting their rights, the user's personal data may be communicated, without their consent, to individuals and companies that provide legal, tax, administrative, or technical defense and assistance services, both judicial and extrajudicial, which will act as independent Data Controllers.
11) Dissemination and transfer of personal data to countries outside the EU or to international organizations
The Data Controller will not disclose the user's personal data and will not transfer them outside the European Union or to international organizations.
12) Retention period of personal data
Considering that the guarantee provided by civil law regarding the sale of products to consumers is 2 years from the delivery of the sold goods, the personal data provided by the data subject for the purpose of purchasing products through the site and allowing the Data Controller to fulfill the related contractual and legal obligations will be retained for a period not exceeding 2 years from the termination of the contractual relationship, unless a prior request for deletion is made by the data subject.
Personal data processed for promotional, commercial, and broadly marketing purposes as per Article 3, letter d), will be retained for a period not exceeding 12 months from collection.
Navigation data will be retained for a period not exceeding one month.
In any case, the terms of five or ten years for the retention of only documents and related data for the fulfillment of civil, accounting, and tax obligations prescribed by current legislation will be respected, as well as for the protection in court of the rights of the Data Controller.
13) Rights of the data subject
Pursuant to Article 7 of the Privacy Code and Articles 13, paragraph 2, letters b) and d), 15, 18, 19, 21, of EU Regulation No. 2016/679, the user may at any time exercise the rights referred to in the aforementioned Article 7 of the Privacy Code as well as the rights referred to in Articles 15 to 23 of the aforementioned EU Regulation.
In particular, the data subject may exercise:
– the right to access one's personal data and to obtain confirmation of the existence or non-existence of personal data concerning them, even if not yet recorded, and the communication in an intelligible form of the same data, as well as the right to data portability (i.e., the right to receive the personal data provided, in a structured, commonly used, and machine-readable format);
– the indication of their origin, the purposes and methods of processing, as well as, in the case where processing is carried out using electronic tools, the logic on which the processing is based; the indication of the identifying details of the data controller and any data processors;
– the indication of the subjects and categories of subjects to whom personal data may be communicated or who may become aware of them as data controllers or processors;
- the updating, rectification or, if interested, the integration of the data;
- the deletion, transformation into anonymous form or blocking of data processed in violation of the law, including those for which retention is not necessary in relation to the purposes for which the data was collected or subsequently processed;
- to object, in whole or in part, for legitimate reasons, to the processing of personal data concerning them, even if relevant to the purpose of collection; to object to the processing of personal data concerning them intended for commercial information or for sending advertising material or direct sales or for conducting market research or commercial communication;
- to obtain the rectification and/or deletion of the same and/or the limitation of the processing concerning them;
- to withdraw consent to processing, if the processing is based on their consent, without prejudice to the processing already carried out;
- to lodge a complaint with the supervisory authority. This authority is represented, in Italy, by the Guarantor for Privacy, based in Rome, Piazza Monte Citorio n. 121, postal code 00186.
14) Use of automated decision-making processes and profiling by the Data Controller
The Data Controller will not subject the user's personal data to automated decision-making processes, including profiling.
15) Data Controller
For the exercise of their rights, the user can contact, at any time, the Data Controller, whose identifying details are: “Profumeria S.r.l.s.”, VAT no. P.IVA 09756501210, with legal headquarters in Naples, via Nuova San Rocco n. 95, postal code 80131
The Data Controller provides users of the site with the following email address for the exercise of rights, also with reference to requests made to third parties to whom the data has been communicated with the prior specific consent of the data subject: info@frascognashop.it
At the indicated headquarters of the Data Controller, the updated list of appointed data processors is available.
The user is also invited to contact:
The Data Controller:
“C. Frascogna S.r.l.”, VAT no. P.IVA 06932191213, with legal headquarters in Naples, via Miano n. 112, postal code 80145, email info@frascognashop.it.
The Data Protection Officer is: “C. Frascogna S.r.l.”, VAT no. P.IVA 06932191213, with legal headquarters in Naples, via Miano n. 112, postal code 80145, email info@frascognashop.it.