Mastelli s.r.l. (“Company”) takes the user’s privacy very seriously and is committed to respecting it within the terms of the applicable regulations (Regulation (EU) 2016/679 - hereinafter referred to as the “Regulation”).
This document (“Privacy Policy”) provides information on the processing of personal data collected by the Company through this website (“Website”) and therefore constitutes information to data subjects in accordance with the aforementioned regulations.
Data Controller and DPO
The data controller is Mastelli s.r.l. with registered office in Via Bussana Vecchia 32, 18038 Sanremo (“Data Controller”).
The Data Protection Officer (“DPO”) can be contacted at the following address: privacy@mastelli.it
What data we process
The following may be subject to processing:
1) Any common personal data that may be provided by the user when interacting with the Website’s functionalities, including navigation data or requests to use the services offered on the Website (registration to any reserved areas/competitions and other initiatives, use of any Apps, requests for information and notifications also through contact forms, etc.), as well as data collected through cookies as specified in the Cookies Policy;
2) Sensitive personal data such as those relating to health or belonging to special categories of personal data pursuant to Art. 9 of the Regulation. Where this is the case, such processing is carried out on the basis of the user’s consent, as well as for the purpose of complying with reports of adverse events, fulfilling obligations arising from laws or regulations, or fulfilling contractual or pre-contractual obligations relating to the provision of goods or services (including the request for information on our products and their proper use). In any case, the legal basis for the processing of special categories of data is Art. 9.2 (a), (g) and (i) of the Regulation.
Why we process the user’s personal data and how
With the user’s consent, the Company may process the user’s common personal data in order to allow the use of services and functions on the Website and to optimise its operation, to manage requests and notifications received through the Website, for registration to any reserved areas, pursuant to art. 6.1.(a) of the Regulation. The Company may also process the user’s personal data to fulfil obligations arising from laws, regulations, EU legislation: the legal basis for processing for this purpose is art. 6.1.(c) of the Regulation.
Again with the user’s optional consent, common and/or special data may be processed for the management of applications pursuant to Articles 6.1.(a) and 9.2.(a) of the Regulation. The user’s common and special data may also be processed for the handling and fulfilment of reports of adverse events, pursuant to Articles 9.2. letters (a), (g) and (i) of the Regulation.
Furthermore, with the user’s optional consent, common data may also be used for the purpose of institutional communications (including newsletters). The legal basis for processing for this purpose is Art. 6.1.(a) of the Regulation.
Lastly, the user’s common and/or particular personal data may be processed by the company to protect its rights in court, or for the application of Mastelli’s Code of Ethics (Articles 6.1.(f) and 9.2.(f). of the Regulation).
All user data are also processed using paper and automated tools that are in any case suitable to guarantee security and confidentiality.
Necessary and optional processing
The forms to be filled in on this website envisage both data that are strictly necessary to handle the user’s communications and requests, marked with the symbol [*], the failure to indicate which does not allow the requests to be followed up, and optional data that are not strictly necessary to follow up the requests of the data subjects. Failure to provide these will not have any consequences.
Browsing data
The processing of the personal data of users who only visit the Website (i.e., without sending communications or using any of the available services/functions) is limited to navigation data, i.e., those whose transmission to the Website is necessary for the operation of the computer systems in charge of managing the Website and of the Internet communication protocols. This category includes, for example, IP addresses or the domain of the computer used to visit the Website and other parameters relating to the operating system used by the user to connect to the Website. The Company collects these and other data (such as, for example, the number of visits and the time spent on the Website) only for statistical purposes and in an anonymous form in order to monitor the operation of the Website and improve its functionality. This information is not collected in order to be associated with other information about users and identify them; however, this information by its very nature may enable users to be identified through processing and association with data held by third parties. Browsing data are normally deleted after processing in anonymous form but may be retained and used by the Company to ascertain and identify the perpetrators of any computer crimes committed against the Website or through the Website. Except for this eventuality and as specified in the Cookies Policy section, the browsing data described above are only temporarily stored in accordance with applicable law.
Links to other websites
The Website may contain links to other websites (known as third-party websites). The Company has no access to or control over cookies, web beacons and other user tracking technologies used by third-party websites that the user may access from the Website; the Company has no control over the content and material published by or obtained through third-party websites, nor over the manner in which the user’s personal data are processed, and expressly disclaims any responsibility for such eventualities. The user is required to check the privacy policy of third-party websites accessed through the Website and to inform him- or herself of the conditions applicable to the processing of his or her personal data. This Privacy Policy applies only to the Website as defined above.
How we store data and for how long
In accordance with the requirements of Art. 5.1.(c) of the Regulation, the information systems and computer programmes used by the Company are configured in such a way as to minimise the use of personal and identification data; such data are processed only to the extent necessary to achieve the purposes set out in this Policy; the data will be retained for the period of time strictly necessary to achieve the purposes concretely pursued and, in any case, the criterion used to determine the retention period is based on compliance with the terms permitted by applicable laws and the principles of minimising processing, limiting retention and the rational management of archives.
How we ensure the security and quality of the personal data
The Company is committed to protecting the security of the user’s personal data and complies with the security provisions laid down in the applicable legislation in order to prevent loss of data, illegitimate or unlawful use of the data and unauthorised access thereto, with particular but not exclusive reference to Articles 25-32 of the Regulation. The Company uses a variety of advanced security technologies and procedures to help protect users’ personal data; for instance, the personal data are stored on secure servers located in places with protected and controlled access. The user can help the Company update and keep his or her personal data correct by communicating any changes to his or her address, job title, contact information, etc.
Who can access the data
The Company’s personnel belonging to the categories of administrative staff, IT technicians, product managers, etc. and other persons who need to process them in the performance of their duties are authorised to process the user’s data.
The Data may be communicated, also in Third Countries, to: (i) institutions, authorities, public bodies for their institutional purposes; (ii) professionals, self-employed collaborators, also in associated form; third parties and suppliers which the Data Controller uses for the provision of services of a commercial, professional and technical nature functional to the management of the Website and its functions (e.g., suppliers of IT services and Cloud Computing), to the pursuit of the purposes specified above and to the services requested by the user; (iii) third parties in the event of mergers, acquisitions, sale of a company or business unit, audits or other extraordinary operations. These parties will only receive the data necessary for the relevant functions and will undertake to use them only for the above-mentioned purposes and to process them in accordance with the applicable privacy regulations. The data may also be disclosed to the legitimate recipients in accordance with applicable law. With the exception of the above, the data are not shared with third parties, natural or legal persons, who do not perform any commercial, professional or technical functions for the Controller, and will not be disseminated. The recipients of the data process them as Controllers, Processors or data processing appointees, as the case may be, for the purposes indicated above and in compliance with the applicable privacy law.
With regard to the possible transfer of data to third countries, including countries that may not guarantee the same level of protection provided for by the Privacy Legislation, the Controller hereby informs the users that the processing will in any case take place in accordance with one of the methods permitted by the Regulation, such as the user’s consent, the adoption of Standard Clauses approved by the European Commission, the selection of subjects adhering to international programmes for the free circulation of data or operating in countries considered secure by the European Commission.
Users’ rights
The user may at any time exercise the rights recognised in Articles 15-22 of the Regulation, including the right to obtain confirmation of the existence or non-existence of personal data concerning him or her, to verify their content, origin, accuracy, location (also with reference to possible third countries), to ask for a copy, to ask for their rectification and, in the cases provided for by the applicable law, to request the restriction of their processing, their deletion, opposition for direct contact activities (also just for certain means of communication). Similarly, the user may always withdraw his or her consent and/or report observations on specific uses of data regarding particular personal situations that are deemed incorrect or not justified by the relationship in place, or lodge a complaint with the Italian Data Protection Authority.
For any request relating to the processing of personal data by the Company, to exercise the rights recognised by the applicable legislation, as well as to know the updated list of subjects to which the data are accessible, the user may contact the Data Controller and/or the DPO at the addresses indicated above.