Privacy Policy

2. PURPOSE, LEGAL BASIS OF THE PROCESSING, AND LEGITIMATE INTEREST
Pursuant to Article 6 paragraph 1 a), b) and f), the personal data voluntarily provided will be processed for the following purposes, until your opposition:

• browsing on this website;
• contact request by filling in forms;
• request to send newsletters (subject to your explicit consent).

The data processing is based on Article 6, paragraph 1 f): (Recital 47), taking into account the reasonable expectations of the data suubject at the time and in the context of the collection of personal data, when the data subject can reasonably expect that processing for this purpose takes place.

• browsing data;
• contact and information requests: maximum 12 months;
• sending of newsletters (until consent is revoked).

The data processing connected to the web services offered by this site are physically ""hosted"" by Aruba SpA on a server located in Italy.

• employees and collaborators;
• freelancers;
• firms or companies within the context of support and consultancy relationships;
• competent authorities for the fulfilment of legal obligations and/or provisions of public bodies, upon request.

The persons belonging to the above categories act as Data Processors (Article 28 of (EU) Reg. 2016/679) and/or as natural persons acting under the authority of the Data Controller and the Data Processor (Article 29 of EU Reg. 2016/679), or operate in total autonomy as separate Data Controllers. The list of data processors is constantly updated and available at the headquarters of Nicol Preziosi S.r.l. - via Martiri della Libbia, 25 - 52031 Anghiari (AR).

5. AUTOMATED PROCESS AND PROFILING
The processing of your data will not be subject to either automated processing or profiling activities.

6. NATURE OF PROVISION AND REFUSAL
Apart from what is specified for navigation data, the user is free to provide personal data. The provision of data is optional but necessary to complete the sending of information requests, for contact by the Data Controller and to complete the subscription to the newsletter. Failure to provide personal data may make it impossible to obtain feedback from the Data Controller and to use the services requested.

7. RIGHTS OF THE DATA SUBJECTS
You can assert your rights as expressed by (EU) Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016, by contacting the Data Controller:

• by telephone at our regional office on 0575 788494
• by sending an email to info@nicolpreziosi.it
• by sending a registered letter with return receipt to Nicol Preziosi Srl - via Martiri della Libbia, 25 - 52031 Anghiari (AR).

Pursuant to Articles 13, paragraphs 2 and 15-22 of the Regulation, we inform you that with regard to the processing of your personal data, you can exercise the following rights: a) Right to obtain access to personal data and the following information:

• confirmation of whether or not the personal data is being processed;
• the purposes of the processing;
• the categories of personal data;
• the recipients or categories of recipients to whom the personal data has been or will be disclosed;
• if the data is not collected from the data subject, all available information on its origin;
• the existence of an automated decision-making process, including profiling;
• a copy of the personal data being processed.

b) Right of rectification and integration of personal data;
c) Right to delete data (""right to be forgotten"") if one of the following reasons exists:

• the personal data is no longer necessary with respect to the purposes for which it was collected or otherwise processed
• the interested party revokes the consent to the processing of data and there is no other legal basis for the processing
• the interested party opposes the processing and there is no legitimate overriding reason to proceed with the processing
• the personal data has been unlawfully processed
• the personal data must be deleted to fulfill a legal obligation under Union law or the law of the Member State to which the data controller is subject

The data controller, if he has made personal data public and is obliged to delete it, must inform the other data controllers who process the personal data of the request to delete any link, copy or reproduction of the data. d) Right to limitation of processing in the event that:

• the data subject disputes the accuracy of the personal data, for the period necessary for the data controller to verify the accuracy of such personal data
• the processing is unlawful and the data subject opposes the cancellation of the personal data and requests instead that its use be limited
• although the data controller no longer needs it for processing purposes, the personal data is necessary for the data subject to ascertain, exercise or defend a right in court
• the data subject has opposed the processing, pending verification of the possible prevalence of the legitimate motives of the data controller with respect to those of the data subject

e) Right to lodge a complaint with the Authority for the protection of personal data, following the procedures and indications published on the Authority's official website at www.garanteprivacy.it.
f) Right to data portability or the right to receive in a structured format, commonly used and readable by an automatic device, the personal data concerning him/her provided to a data controller and possibly transmit it to another data controller, if the processing is based on consent or a contract and is carried out by automated means. Where technically possible, the data subject has the right to obtain the direct transmission of data from one data controller to another.
g) Right to object at any time to the processing of personal data, including profiling, in particular in the event that:

• the processing takes place on the basis of the legitimate interest of the Controller, subject to an explanation of the reasons for the objection
• the personal data is processed for direct marketing purposes.

h) Right not to be subjected to a decision based solely on automated processing, including profiling, except in cases where the decision: is necessary for the conclusion or execution of a contract between the data subject and a data controller, is authorised by the Union law or the Member State law to which the data controller is subject, or is based on the the data subject's explicit consent.
i) Right to withdraw consent at any time.
The exercise of rights is not subject to any formal constraints and is free of charge.

8. MINORS
This Site and the Data Controller's Services are not intended for children under the age of 18 and the Data Controller does not intentionally collect personal information from minors. In the event that information relating to minors is unintentionally recorded, the Data Controller shall promptly delete it at the user's request."