INFORMATION ON PROCESSING OF PERSONAL DATA FOR CUSTOMERS AND SUPPLIERS
This notice (hereinafter referred to as Privacy Notice) relates to the Processing of your Personal Data carried out by Dr. Vranjes Firenze S.p.A., with registered office at Via S. Pertini, 5 - Antella 50012 Bagno a Ripoli (FI), Italia, VAT Reg. No. 01648260, e-mail info@drvfirenze.com (hereinafter referred to as the “Controller”), pursuant to the Regulation (EU) 2016/679 (hereinafter referred to as “GDPR”).
1. Identity and contact details of the data controller
The Data Controller is established in Italy; therefore, no representative has been appointed.
2. DPO contact data
The Data Controller has appointed a Data Protection Officer (“DPO”) pursuant to Art. 37 GDPR. The DPO can be contacted at the following address dpo@drvfirenze.com
3. Third-party data
Should the customer and/or supplier provide the Data Controller with personal data belonging to third parties, their employees and/or collaborators, for the purposes of executing the contract, the customer and/or supplier must inform the third party of this circumstance, as well as provide the third party with this privacy policy and obtain, where necessary, appropriate consent.
4. Purpose and legal basis of processing
Personal data will be processed for the following purposes:
- a) For contractual purposes and/or purposes related to the execution of pre-contractual measures adopted at your specific request, as well as to fulfil any legal obligations related to such purposes. In this case, the legal basis is the need to process the data for the purpose of performing the contract and/or managing pre-contractual relations.
- b) to send you direct marketing communications, newsletters, advertising material, using traditional contact methods and automated IT systems, including direct marketing information via email or SMS, or for market research and analysis. The legal basis for the processing is the consent, given pursuant to the Privacy Notice.
- c) to identify your habits and preferences through profiling, in order to provide you with a personalised service. The legal basis is your consent, given pursuant to the Privacy Notice. With regard to personal data processed, provision of personal data is not a contractual obligation. You may choose to provide your personal data. If you fail to provide this information, the Company will not be able to provide you with a personalised service.
- d) for purposes related to relevant legal obligations. The legal basis for processing is the legal obligation of the Data Controller to process personal data according to the applicable legislation.
5. Conditions for consent
Consent, where required, may be expressed by signing a paper or electronic document, or even by ticking specific flag boxes.
6. Processing methods and logic
- With regard to personal data processed and stored for the purposes referred to in point a), number 4 of this notice (contractual and pre-contractual purposes), processing will be carried out using paper-based tools, automated logic and CRM management software, which will enable us to better manage the fulfilment of our contractual obligations.
- With regard to personal data processed for the purposes referred to in point b) number 4 of this Privacy Notice (marketing purposes), processing will be carried out using software designed to send direct marketing information.
- With regard to personal data processed for the purposes referred to in point c) number 4 (profiling), processing will be carried out using CRM software that allows us to define tastes and preferences in order to offer you personalised services and information. For further details, please go to the next point of the Privacy Notice.
- With regard to personal data processed and stored for the purposes referred to in point d), number 4 (legal purposes), processing will be carried out using paper-based tools, automated logic and CRM management software, which will enable us to better manage compliance with legal obligations.
7. Automated decision-making and profiling
If you authorise the processing of your personal data to benefit from personalised services through profiling, your personal data may be subject to automated decision-making process, with a specific algorithm deciding which information is most suitable for your profile or which may be of most interest to you. The expected result of such processing, by way of example, could consist in sending highly profiled direct marketing information, discounts, invitations to events deemed to be of interest, etc.
Pursuant to Art. 22 GDPR, you have the right to:
- obtain human intervention by the Controller in the decision-making process.
- express your opinion.
- obtain clarifications on the decision made by the Controller.
- challenge the above decision.
8. Source of personal data
Only data provided in accordance with this policy will be processed. Personal data from publicly accessible sources will not be processed.
9. Recipients and any recipient categories of personal data
Personal data may be sent to the following recipients:
- companies offering information society services, including, in particular, those offering hosting services.
- auditing firms.
- the Data Controller's partner companies.
10. Data categories
Personal data will be processed, including, but not limited to personal details, contact details. Under no circumstances may special categories of data be processed pursuant to Article 9 of the GDPR.
11. Transfer of personal data
The Data Controller intends to transfer personal data to third countries outside the European Union or international organisations Such entities could include, for example:
- Communication companies that carry out communication activities on behalf of the Data Controller.
- Service provider of the communication company.
- Subsidiaries and/or parent companies.
The transfer of personal data to such entities, if located in a third country or an international organisation, is carried out if an adequacy decision has been issued by the European Commission, which has verified that the third country, the territory or one or more specific sectors within the third country, or the international organisation in question, ensure an adequate level of protection of rights. However, the Data Controller reserves the right, if he/she deems it appropriate, to enter into specific separate agreements that oblige such parties to adopt adequate security measures, including organisational measures, aimed at providing appropriate guarantees regarding rights. The data may be then transferred to the following countries: United States of America, United Kingdom, Japan. To obtain a copy of such data or the location where it has been made available, simply send a request to the Data Controller at the addresses listed above.
12. Personal Data retention period
- Personal data processed and stored for the purposes referred to in points a) and d), number 4 (contractual and pre-contractual purposes and fulfilment of legal obligations) are processed and stored by the Data Controller in accordance with current legislation, in any case for a period of time not exceeding 10 years from the termination of the contract in the event of its conclusion, unless otherwise required by law;
- Personal data processed for the purposes referred to in point b) number 4 of this policy (marketing purposes) are processed and stored by the Data Controller until you request their deletion and/or revocation, as the Data Subject.
- Personal data processed for the purposes referred to in point c) number 4 (preference setting purposes) are processed and stored by the Data Controller for a period not longer than 12 months from the collection.
13. Optional nature of consent and implications of failed consent
- With regard to personal data processed for the purposes referred to in point a) number 4 of this notice (contractual and pre-contractual purposes) the disclosure of personal data is mandatory. If you fail to provide such personal data, no contracts will be signed.
- With regard to personal data processed for the purposes referred to in point b) number 4 of this notice (marketing purposes), the provision of personal data is not a contractual obligation. You may choose to provide your personal data. If you fail to provide such personal data, the Data Controller will not be able to carry out any marketing activity.
- With regard to personal data processed for the purposes referred to in point c) number 4 of this policy (setting preferences purpose), the provision of personal data is not a contractual obligation. You may choose to provide your personal data. Should you fail to provide your personal data, the Company will not be able to carry out any profiling activity.
- With regard to personal data processed for the purposes referred to in point d) number 4 of this policy (legal obligations), the provision of personal data is a legal obligation.
14. Right to object
The data subject shall have the right to object according to the following terms:
- The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise, or defence of legal claims.
- Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.
- Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes. It should be noted that the data subject's right to object to the processing of their personal data for the aforementioned purposes may also be exercised in part, i.e. by objecting, for example, only to the sending of promotional communications via automated and/or digital means, or to the sending of paper communications.
- Where personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1), the data subject, on grounds relating to his or her particular situation, shall have the right to object to processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
15. Other rights
The Data Controller also intends to provide information of the following rights:
- Right of access: The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is that is the case, access to the personal data and specific information pursuant to Art. 15 GDPR;
- Right to rectification: The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement, pursuant to Art. 16 GDPR.
- Right to erasure of personal data, including the right to withdrawal of consent: The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where the grounds provided for by Art. 17 GDPR apply. With regard to the right to withdrawal, the data subject also has the right to withdraw consent at any time without prejudice to the lawfulness of the processing based on the consent given prior to withdrawal.
- Right to restriction of processing: The data subject shall have the right to obtain from the controller restriction of processing where the cases provided for by Art. 18 GDPR apply.
- Right to data portability: The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller in the events and at the conditions provided for by Art. 20 GDPR.
- Right to object of the data subject to marketing information: the data subject shall have the right to object at any time, free of charge, to receiving direct marketing information.
16. Exercise of rights
Requests to exercise the rights indicated in this policy, including the right to erasure and the right to withdraw consent, should be addressed directly to the Data Controller at the following email address: privacy@drvfirenze.com. Alternatively, you may exercise your rights by sending a registered letter with return receipt to the Data Controller's registered office.
17. Accessibility to the Privacy Notice
The privacy notice is available from the Data Controller. If expressly requested, the information may also be provided verbally, provided that the identity of the requester is verified, by means of a telephone request to the Data Controller's contact details.
DATA PROCESSING BY DR. VRANJES FIRENZE S.P.A. FOR MARKETING AND PROFILING PURPOSES
This privacy policy governs the processing of personal data through the use of the website available at https://drvranjes.it/it/privacy-policy, Dr. Vranjes Firenze S.p.A., with headquarters at Via S. Pertini, 5 - Località Antella 50012 Bagno a Ripoli (FI), Italy, VAT No. 06511260488, email address privacy@drvranjes.it, (hereinafter the "Data Controller"), in accordance with applicable data protection laws, including, in particular, EU Regulation 2016/679 (hereinafter the "GDPR").
- Identity and contact information of the data controller
- Contact Information for the Data Protection Officer
- Methods of processing
The Data Controller is Dr. Vranjes Firenze S.p.A.
Since the Data Controller is established in Italy, no representative has been appointed.
The Data Controller has appointed Simone Bonavita as Data Protection Officer; he may be contacted at the Data Controller's office or at dpo@drvranjes.it
3.1 Cookies and environmental data
TECHNICAL COOKIES
Navigation, functional, and session cookies: these enable the website to function properly. The use of so-called session cookies (which are not stored permanently on the data subject's device and are automatically deleted when the browser is closed) is strictly limited to the transmission of identifiers for individual sessions, and they are used to enable the secure and efficient use of the website. They are categorized as follows:
- activities strictly necessary for operation: cookies used to save the User's session and to perform other activities strictly necessary for the application's operation, for example, in relation to traffic distribution;
- activities related to saving preferences, optimization, and statistics: cookies used to save browsing preferences and optimize the User's browsing experience. These cookies include, for example, those used to set the language and currency or for the website owner to manage statistics.
Statistical cookies:
The website uses statistical cookies created directly by the data controller, as a first party, or provided by third parties. In the latter case, appropriate measures have been taken to reduce their ability to identify users, including by masking significant portions of the IP addresses processed in this manner. Furthermore, the use of these third-party statistical cookies is subject to contractual obligations requiring the third party to use them exclusively for the provision of the service, to store them separately, and not to "enrich" or "cross-reference" them with other information in their possession. With specific regard to Google Analytics cookies, the information collected by the cookies regarding users' use of the website will be transmitted by the user's browser to Google Inc., located at 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States, and stored on the company's servers.
Google's privacy policy, which we encourage you to read, is available at the following address: http://www.google.com/intl/it/privacy/privacy-policy.html
The privacy policy for Google Analytics services is available at the following address: http://www.google.com/intl/en/analytics/privacyoverview.html
Browsing Data and Environmental Variables: The computer systems and procedures used to operate the website automatically collect, during their normal operation, certain personal data related to the user's browsing activity, including environmental variables. This category of data includes, by way of example:
- the IP addresses of the computers used by users accessing the service;
- the number of visits;
- the pages viewed;
- the date and time of access;
- the URL the browser was on before displaying our page;
- the type of web browser;
- the operating system used.
NON-TECHNICAL COOKIES
Profiling cookies:
The site uses profiling cookies provided by third parties. Specifically, the following are used:
- Interaction with social networks and external platforms: This type of service allows you to interact with social networks or other external platforms directly from the pages of this application. The interactions and information collected by this application are, in any case, subject to the User's privacy settings for each social network.
If a social media interaction service is installed, it is possible that—even if Users do not use the service—it may still collect traffic data related to the pages on which it is installed.
AddThis (AddThis Inc.): This is a service provided by Clearspring Technologies Inc. that displays a widget enabling interaction with social networks and external platforms and the sharing of this application's content. Depending on the configuration, this service may display widgets belonging to third parties, such as the operators of the social networks on which interactions are shared. In this case, the third parties providing the widget will also become aware of the interaction that took place and of usage data related to the pages where this service is installed.
Personal Data Collected: Cookies and Usage Data.
Place of processing: USA – Privacy Policy. - Remarketing and behavioral targeting: This allows this application and its partners to communicate, optimize, and serve advertisements based on the User's past use of this Application. This activity is carried out by tracking usage data and using cookies; this information is transferred to the partners associated with the remarketing and behavioral targeting activities. In addition to the opt-out options offered by the services listed below, the User may opt out of receiving cookies related to a third-party service by visiting the Network Advertising Initiative's opt-out page.
Facebook Remarketing (Facebook, Inc.): This is a remarketing and behavioral targeting service provided by Facebook, Inc. that links the activity of this Application with the Facebook advertising network.
Personal Data collected: Cookies and Usage Data.
Place of processing: USA – Privacy Policy – Opt Out.
AdWords Remarketing (Google Inc.): This is a remarketing and behavioral targeting service provided by Google Inc. that links the activity of this Application to the AdWords advertising network and the DoubleClick cookie.
Personal Data Collected: Cookies and Usage Data.
Place of processing: USA – Privacy Policy – Opt Out. - Statistics: The services included in this section allow the Data Controller to monitor and analyze traffic data and are used to track User behavior.
Google Analytics with anonymized IP (Google Inc.): This is a web analytics service provided by Google Inc. ("Google"). Google uses the Personal Data collected to track and examine the use of this Application, compile reports, and share them with other services developed by Google. Google may use the Personal Data to contextualize and personalize the ads in its advertising network. This integration of Google Analytics anonymizes your IP address. Anonymization works by shortening Users' IP addresses within the borders of European Union member states or in other countries that are party to the European Economic Area agreement. Only in exceptional cases will the IP address be sent to Google's servers and shortened within the United States.
Personal Data collected: Cookies and Usage Data.
Place of processing: USA – Privacy Policy – Opt Out
Facebook Ads Conversion Tracking (Facebook, Inc.): This is a statistics service provided by Facebook, Inc. that links data from the Facebook ad network with actions taken within this Application.
Personal Data Collected: Cookies and Usage Data.
Place of processing: USA – Privacy Policy
Criteo Dynamic Retargeting: A remarketing service provided by Criteo SA.
Personal Data Collected: Cookies and Usage Data.
Place of processing: France
Privacy Policy - https://www.criteo.com/it/privacy/
Opt Out - https://privacy.eu.criteo.com
Deleting and Disabling Cookies
Since cookies are standard text files, you can access them using text editors. In any case, you can configure your browser to prevent it from handling cookies.
Delete/disable cookies in Firefox:
http://support.mozilla.com/it/kb/Eliminare%20i%20cookieDeleting/disabling cookies in Edge:
https://support.microsoft.com/it-it/help/4027947/windows-delete-cookiesDelete/disable cookies in Chrome:
http://support.google.com/chrome/bin/answer.py?hl=it&answer=956473.2 Data Provided Voluntarily by the Data Subject
Data voluntarily and freely provided by the data subject by sending an email to the addresses listed on the website may be collected for the purpose indicated in section 4.
In particular, in addition to the email address necessary to reply to the sender, any other personal data contained in the relevant communication will be processed.
- Purposes of Processing and Legal Basis for Processing
- To send direct marketing communications, newsletters, and advertising materials via traditional contact methods and automated computer systems, including commercial or promotional communications via email or SMS, or for market research and analysis. In this case, the legal basis is consent, provided in accordance with this privacy policy;
- For profiling activities and to determine habits and preferences. In this case, the legal basis is consent, given in accordance with this privacy policy.
Consent to the processing of personal data through non-technical cookies may be given:
- By clicking on a specific checkbox displayed within a banner.
Only data provided by the data subject in accordance with this privacy policy and collected through the website will be processed.
The recipients of the data subject's personal data may include:
- communications companies that carry out commercial communication and profiling activities on behalf of the Data Controller, which act as data processors;
- companies that provide information society services, including, in particular, those that offer hosting services.
The data subject's personal data will be processed.
The Data Controller intends to transfer personal data to a third country or to an international organization. Such entities may include, by way of example:
- communications companies that carry out communication activities on behalf of the Data Controller;
- companies that provide information society services, including, in particular, those that offer hosting services;
- communications service providers.
The transfer of personal data to such entities, if they are established in a third country or are an international organization, is carried out pursuant to an adequacy decision by the European Commission, which has verified that the third country, the territory, or one or more specific sectors within the third country, or the international organization in question, ensures an adequate level of protection for your rights. In any case, the Data Controller—should it deem it appropriate—reserves the right to enter into specific, separate agreements that require such entities to adopt adequate security measures, including organizational ones, aimed at providing appropriate safeguards regarding your rights. Google Inc., in particular, is contractually bound to ensure adequate protection of the data subject's rights. The data may thus be transferred to the following countries: the United Kingdom and the United States of America. To obtain a copy of such data or to find out where it has been made available, simply send a request to the email address privacy@drvranjes.it.
Personal data processed for marketing purposes is processed and retained until the data subject requests the revocation of consent or the deletion of such data.
Personal data processed for the purpose of determining preferences is processed and retained for a period not exceeding 12 months from the date of collection.
The Data Controller reserves the right, in any case, to request that the data subject renew their consent to processing and/or to verify the consents already given.
With regard to personal data processed for marketing purposes, the provision of personal data is not a contractual obligation. You have the option to provide your personal data; however, if such data is not provided, it will not be possible to carry out any marketing activities;
With regard to personal data processed for profiling purposes, the provision of personal data is not a contractual obligation. You have the option to provide your personal data; however, if you do not provide such data, it will not be possible to carry out any profiling activities.
12.1 Right to Object
With regard to personal data processed through technical cookies to enable proper use of the website, the provision of personal data is not a contractual obligation but is based on the legitimate interest of the data controller, since without such processing, the fully functional website could not be made available.
Consent is considered optional with regard to non-technical cookies. In the latter case, failure to provide such data will only result in the inability to provide a personalized service. With regard to data voluntarily provided via email, consent is considered optional. However, failure to provide such data will result in the inability to respond to data subjects;
With regard to data provided for contractual and pre-contractual purposes, the provision of personal data is a contractual obligation and a necessary requirement for conducting pre-contractual negotiations and for concluding the contract. The data subject has the right to choose whether to provide personal data; however, failure to provide such data will make it impossible to conclude any contract or conduct any contractual negotiations;
With regard to data provided voluntarily via email, failure to provide such data will make it impossible to respond to the data subject's requests.
12.2 Other Rights
The Data Controller also wishes to inform the data subject of the following rights:
Right of access:
The data subject has the right to obtain from the Data Controller confirmation as to whether or not personal data concerning him or her are being processed and, if so, to obtain access to the personal data and to specific information, in accordance with Article 15 of the GDPR.
Right to rectification:
The data subject has the right to obtain from the Data Controller the rectification of inaccurate personal data concerning him or her without undue delay. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by providing a supplementary statement, in accordance with Article 16 of the GDPR.
Right to erasure, including the right to withdraw consent:
The data subject has the right to obtain from the Data Controller the erasure of personal data concerning him or her without undue delay, and the Data Controller is obligated to erase personal data without undue delay, or to revoke consent, if the grounds set forth in Article 17 of the GDPR apply. With regard to the right to withdraw consent, the data subject also has the right to withdraw consent at any time without affecting the lawfulness of processing based on consent given prior to withdrawal.
Right to restriction of processing:
The data subject has the right to obtain from the Data Controller the restriction of processing when the circumstances defined in Article 18 of the GDPR apply.
Right to Data Portability:
The data subject has the right to receive, in a structured, commonly used, and machine-readable format, the personal data concerning him or her that has been provided to the Data Controller, and has the right to transmit such data to another data controller without hindrance from the Data Controller in the cases and under the conditions specified in Article 20 of the GDPR.
Requests to exercise the rights set forth in this privacy notice—including, in particular, the right to erasure and the right to withdraw consent—must be addressed directly to the Data Controller at the email address privacy@drvranjes.it. Alternatively, you may exercise your rights by sending a notice via certified mail with return receipt to the address: Via S. Pertini, 5 - Località Antella 50012 Bagno a Ripoli (FI).
This Privacy Policy is available at https://drvranjes.it/it/privacy-policy, as well as from the Data Controller. If expressly requested by the data subject, the information may also be provided orally, provided that the data subject's identity is verified, by making a telephone request to the Data Controller's contact numbers.