ATELIER LIVIA PERTILE
a r t i n m o t i o n t h e c o u r a g e t o s u r p r i s e
+39 3480537810 / +39 3386135193
COMPANY WEBSITE - PRIVACY POLICY
Articles 13-14 EU Privacy Regulation 679/2016 (GDPR)
Ver 1.0 of 12.01.2025
Purpose of the document
Consultation of the telematic pages of the www.liviapertile.it website (the 'Website') may entail the processing of personal data, i.e. data relating to identified or identifiable persons (the 'data').
Below we inform you about the processing of the data of users who navigate and interact with the web services accessible by telematic means from the Website.
OWNER
Livia Pertile, C.F. PRTLVI68C45G224A, P.IVA 04065050249, with head office in Contrada Saliceto n. 50 - Gioiosa Marea (ME), e-mail: atelier@liviapertile.it, tel. 348-0537810 and 338-6135193, as Data Controller (the "Controller" or "we") processes data referring to you, as follows.
TYPES OF DATA
Navigation data
When you (including via mobile devices such as smartphones or tablets) access this website or use our services, the computer systems and software procedures used to operate the site acquire, in the course of their normal operation, certain information about you that qualifies as "personal data", the transmission of which is implicit in the use of Internet communication protocols.
These include the hardware model, operating system and version, information on the mobile network and the country from which access is made, the time of the request, the method used to submit the request to the server, the access time, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.), details of the route taken within the web pages with particular reference to the pages visited and other parameters relating to the user's operating system and computer environment (browser used, version, geographical location, last page visited).), details of the itinerary followed within the web pages with particular reference to the pages visited and other parameters relating to the user's operating system and computer environment (browser used, version, geographical location, last page visited before accessing the Website services) and the unique device identifiers (e.g. the IP address or domain names of the computers used by users, the address in URI notation - Uniform Resource Identifier, the MAC address - Media Access Control).
This is information that is not collected in order to be directly associated with identified data subjects, but which by its very nature could, in theory, through processing and association with data held by third parties (in particular, providers of Internet connectivity services used by us), allow users to be identified.
Data actively provided by the user
They are understood as such:
- information sent by users in an optional and voluntary manner by filling in and sending on-line forms (newsletter registration form, contact request form, information, and/or appointment booking form, messages and reviews published by the user on blogs on the site (e.g. name and surname, address, subject and content of an e-mail, etc.). Such data are defined as 'common' (e.g. master data, and field for Message, if any). Any data indicated as "mandatory" (e-mail and text), identified by a specific * in the contact form, are strictly necessary for the provision of services. The other data are useful for the improvement of the services and communications to be provided to the user.
Data collected from third parties
We do not collect personal data from parties other than the external data processors we have designated to carry out the same on our behalf.
PURPOSE OF PROCESSING
Personal data are processed for the purpose of:
- manage access to the Website and the services included therein, in particular: • process user requests for support and contact, e.g. regarding the sending of information material, clarifications and/or offers; • provide the service (e.g. purchase, appointment) requested by you and manage all management and production activities instrumental to the execution of the relevant contract,
- fulfilling obligations provided for by law, regulations and/or EU legislation related to or arising from the aforementioned contractual relationship,
- performing all activities necessary or useful for the technical maintenance of the Website and for the constant improvement of the service provided by the Website (e.g. optimising the user experience, speeding up and simplifying page navigation, text readability, and ensuring the operational continuity of the services provided through the Website),
- for ascertaining liability in the event of offences against the Website and/or third parties carried out through the Website (malware attempts, spamming, unauthorised access to computer systems, etc.),
- defence of the Controller's rights in the event of offences against the Website and/or offences committed through the Website,
- (limited to navigation data) to obtain statistical information in aggregate and anonymous form on the use of the site by users.
- Direct marketing, consisting of sending - to customers, newsletter subscribers or non-customers - promotional communications and offers for the sale of products and services, by e-mail
- Basic profiling, consisting of analysing the reactions of the user receiving our e-mail communications containing and offering products and services (opening the message and any attachments, adherence to the call to action proposed in the message).
LEGAL BASIS FOR PROCESSING
The legal basis for the processing is:
- in relation to the purposes under 1), the need to execute a contract to which you or a person connected to you is a party, or the execution of pre-contractual measures taken at your request,
- in relation to the purposes under 2), the need to fulfil an obligation provided for by law, regulations and/or EU legislation to which we are subject),
- in relation to the purposes under 3) is our legitimate interest in ensuring the proper and continuous functioning of the Website, and in improving its usability for the user;
- in relation to purposes 4-5) is our legitimate interest in the protection of our rights in respect of crimes and/or offences committed against or through the Website, or, as the case may be, the need to comply with any requests from public authorities,
- in relation to the purposes under sub 6) is our legitimate interest in analysing quantitatively and qualitatively the traffic of users of the Website.
- in relation to purpose 7): i) if you are our customer, our legitimate interest in keeping in touch with you in order to offer you products and services similar to those you have already purchased (so called soft spam), ii) if you are a subscriber to our newsletter, your consent to receive the same, iii) if you are not a customer or a subscriber to our newsletter, your prior and specific consent to the processing for direct marketing purposes other than soft spam.
- In relation to purpose 8), our legitimate interest in understanding the actual effectiveness of our advertising messages.
MANDATORY OR OPTIONAL NATURE OF THE PROVISION OF DATA CONSEQUENCES OF REFUSAL TO PROVIDE DATA
The provision of personal, ordinary and special data by you is optional, but an initial refusal to provide the requested data may have the following consequences:
- For data of a priority nature (i.e., to be processed in order to fulfil obligations laid down by rules of a contractual nature or by national laws, or EU regulations, applicable to the contract concluded with you), before the contract: impossibility of establishing the contractual relationship; after the contract has been concluded: impossibility of continuing the management of the contractual relationship or of fulfilling related legal or regulatory obligations;
- For data referring to a single request addressed to us: impossibility of assessing and handling the subject of the request (e.g.: a refusal to provide the e-mail, or the description of the content of a service requested, for an appointment, results in the impossibility of making the appointment; etc.).
- For non-priority data, during or after employment: impossibility for the Company to use the data for the purposes intended.
Where the legal basis for the processing is consent, the latter is always freely negotiable and failure to give consent will prevent us from processing the data for the relevant purpose. In any case, consent may be revoked by you at a later date, without prejudice to the lawfulness of the processing carried out up to the date of revocation.
METHODS OF TREATMENT
Processing will take place electronically, telematically and/or on paper. The logic and forms of organisation of processing will be strictly related to the individual purposes respectively indicated above. The processed data shall be subject to adequate protection measures in order to guarantee the data against the risk of authorised access, alteration, loss or destruction, even accidental, of the data, or non-compliant processing.
The data collected are processed by Livia Pertile's internal delegates with prior written authorisation and duly instructed to the extent strictly necessary for the performance of their respective activities (administrative office, back office, research and development, etc.).
COMMUNICATION
The data processed, may be, in whole or in part, communicated to the following external parties, within the limits strictly pertinent to the purposes specified above/and in any case according to a principle of strict proportionality): 1) public bodies (Offices of the financial administration, etc..); 2) lawyers, chartered accountants and accounting experts; 3) privacy consultants; 4) suppliers of development and technical maintenance services of the Website, suppliers of web hostin services; 5) judicial authorities and judicial police bodies and other auxiliaries of the judicial authorities (upon request, in the cases provided for by law); 6) banks; 7) consultants and other professionals; 8) electronic payment service companies; 9) customers and/or suppliers (to fulfil contractual or legal obligations and manage activities with customers/suppliers).
The third party recipients will process the data either as autonomous data controllers (deciding autonomously on the purposes and means of processing), or as data processors within the meaning of Article 28 of the GDPR, i.e. on our behalf and in accordance with our written directives aimed at ensuring compliance with privacy regulations and under our periodic supervision. A list of the names of the data processors is available upon your request.
DIFFUSION
The data will not be disseminated, with the exception of any blog posts and reviews spontaneously published by you in the blog or reviews active on the Website.
DATA TRANSFER ABROAD
We process data using certain IT tools that transfer data on a non-occasional basis to the following cloud providers based or datacentres outside the EU (so-called 'importers' of personal data):
- MICROSOFT CORPORATION, headquartered at 1 Microsoft Way, Redmond, WA 98052, USA, provider of Microsoft Office and Teams services. See Microsoft Corporation's privacy policy at: https://privacy.microsoft.com/it-it/privacystatement.
- GOOGLE LLC., located at 1600 Amphitheatre Parkway, Mountain View, CA 94043 - USA, as provider of the G-Mail and video conferencing services "Meet". When you use Google Maps to visually represent geographic information, data about your use of the map functions is collected, processed and used by Google. See Google's Privacy Policy, available at https://policies.google.com/privacy?hl=it.
- If you purchase from our e-commerce site and you reside in the EEA, your personal data is communicated to the company SHOPIFY INTERNATIONAL LTD. The data is then sent by it to other Shopify locations and service providers who may be located in other geographic areas, including Canada (where we are based) and the USA. When we send your personal information outside of the EEA, we do so in accordance with applicable law. If you are located in the EEA, when SHOPIFY sends your personal data to Canada, it is protected by Canadian law, which according to the EU Commission's decision guarantees adequate protection of personal data. If personal data are subsequently sent by SHOPIFY outside Canada, for example, to sub-processors, the data are protected by contractual commitments comparable to those in the standard contractual clauses. You can view SHOPIFY's Privacy Policy at the link https://www.shopify.com/legal/privacy.
To the aforementioned transfer to the U.S. we apply, in accordance with Article 46 of the GDPR, an adequate safeguard in the form of the EU Commission's Adequacy Decision of 13 July 2023 regarding the U.S. data protection framework, as amended by the EU and U.S. international convention known as the Trans-Atlantic Data Protection Framework (TADPF).
DURATION OF TREATMENT
Personal data are processed and stored:
- in the pre-contractual phase, for 24 months from the date of collection;
- in connection with the contract concluded with you or third parties connected to you, for the duration of the contract;
- after the termination of the aforementioned contractual relationship, no longer than is necessary to fulfil the aforementioned obligations, tasks or purposes and to prove the fulfilment thereof to the supervisory authorities, i.e. for 11 years (in particular, up to 1 year after the expiry date of our legal storage obligations, which is normally 10 years).
- Data processed for IT security purposes (e.g. logs), for 1 year from the time of collection.
- In the event of extrajudicial or judicial litigation with you and/or third parties, for the time strictly necessary to exercise the protection of the Data Controller's rights.
- Data processed for direct marketing purposes other than soft-spam are processed until you revoke your consent.
- Data processed for basic profiling purposes are retained for a period of 3 years.
After the above-mentioned time limits, the data will be permanently deleted or anonymised.
RIGHTS OF THE DATA SUBJECT
You may exercise the following rights with regard to your personal data:
- request confirmation as to whether or not personal data concerning you are being processed and, if so, to obtain access to the personal data and categories of information contained herein.
- request, and obtain without undue delay, the rectification of inaccurate data; taking into account the purposes of the processing, the integration of incomplete personal data, also by providing a supplementary declaration;
- request the deletion of your data in any of the following cases: (a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; (b) you withdraw the consent on which the processing is based and there is no other legal basis for the processing; (c) you object to the processing, and there is no overriding legitimate ground for the processing (...); (d) the personal data have been processed unlawfully; (e) the personal data must be erased in order to comply with a legal obligation under Union or Member State law to which the data controller is subject;
- request the restriction of the processing, in one of the following cases: a) you contest the accuracy of the personal data, for the period necessary for our verification of the accuracy of such personal data; b) the processing is unlawful and you object to the deletion of the personal data and request instead that their use be restricted; c) although the controller no longer needs them for the purposes of the processing, the personal data are necessary for the establishment, exercise or defence of legal claims;
- obtain from the Controller, upon request, communication of the third party recipients to whom the personal data have been transmitted;
- to receive in a structured, commonly used and machine-readable format the personal data concerning you that you have provided to us and, if technically feasible, to have such data transmitted directly to another data controller without hindrance on our part, if the following (cumulative) conditions are met: a) the processing is based on your consent for one or more specific purposes, or on a contract to which you are party and for the performance of which the processing is necessary; and b) the processing is carried out by automated means (software) (the entire right to so-called "portability"). The exercise of the so-called right to portability is without prejudice to the right to erasure provided for above;
- not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or significantly affects him in a similar way. NB: The data controller does not have any automated decision of the aforementioned kind in place.
- lodge a complaint at any time with the competent supervisory authority under the GDPR (Garante privacy), if he considers his rights have been infringed.
CHANGE OF POLICY
This Privacy Policy from the date of its publication supersedes any previous version thereof. Unless otherwise specified, the previous Privacy Policy will continue to apply to cookies collected up to that time. We reserve the right to make changes to this Privacy Policy at any time by notifying users on this page. Please check this page often, referring to the date of last modification indicated at the bottom. If you do not agree to a future change, you must cease using the features of the Website to which the change relates, otherwise you will be deemed to have accepted the change.
P.IVA 04065050249
C.F. PRTLVI68C45G224A