Privacy Policy
Privacy
MY STYLE BAGS
My style S.r L, registered office in Via Vincenzo Monti 27– 20123 Milano (MI), Italian Fiscal Code and VTA registration number 05636320961 (further on, “data controller”), the data controller, inform you that under article 13 Legislative decree 30.6.2003 n. 196 (further on, “Privacy Code”) and Article. 13 EU Regulation n. 2016/679 (further on, “GDPR”) your data will be processed in the following ways and for the following purposes:
1. Data undergoing processing
The data controller handles personal data, even specific data (for example, name, surname, business name, address, telephone, e-mail address, payment referees) – further on, “persona data” or “data” communicated by you on the occasion of the conclusion of an agreement data controller. Processing personal data means every operation or set of operations made with or without automated processes and applied to personal data or set of personal data, even if not se non registered in a database, as the collection, the registration, the organization, the structuring, the storage, the processing, the selection, the block, the adaptation, the change, the mining, the use, the communication through transmission, the dissemination or any other form of provision, the comparison or the interconnection, the limitation, the erasure or the destruction.
2. Purposes of data processing
Your personal data are processed:
A) Without your given consent (article 24 leter a), b), c) Privacy Code and art. 6 lett. b), e) GDPR), for the following service’s purposes:
- Concluding contracts for the data controller’s services;
- fulfilling the pre-contractual, contractual and fiscal obligation resulting by your outstanding connections with us;
- fulfilling the obligations required by law, by a Regulation, by the Community legislation or by order of the authorities.
- exercising the rights of the data controller, for example the right of defence in court proceedings.
B) To carry out prior your written given consent (article 23 and article 130 Privacy Code and art. 7 GDPR) direct marketing activities, like sending – also by e-mail, SMS and MMS – advertising material, communication having informative and/or promotional contents concerning products or services provided and/or promoted by the data controller or by its trading partners, including gifts and free samples;
We would point out that if you are already our customer we can send you commercial advertising material concerning services and products of the data controller similar to those you have already benefited, if you give your consent (article 130 c. 4 Privacy Code).
3. Processing arrangements
Your personal data processing is realized through the operations mentioned in the Article n. 4 Privacy Code and in the article 4 n. 2) GDPR and precisely: collection, registration, organization, conservation, consultation, processing, selection, mining, use, comparison, interconnection, block, communication, deletion or destruction of the data. Your personal data are submitted to a paper, electronic and /or automated processing.
The data controller will process the personal data as long as necessary to fulfil the purposes above and anyway not more than 10 years from the end of the relationship for the purposes of the service and not more the 2 years from the collecting of the data for the marketing purposes.
4. Access to data
Your data will be available for the purposes mentioned in the Article 2.A) and, if you give your consent 2.B):
- To employees and partners of the data controller or of the companies of the Group in Italy and abroad, in their capacity of representatives and/or internal responsible for the processing and/or system administrators;
- To third party companies or other subjects (indicatively loan banks, professional firms, advisors, trade partners, insurance companies providing insurance services etc.) that carry out outsourcing activities on behalf of the data controller, in their capacity of external responsible for the processing.
5. Data communication
Without the need of a given consent (formerly Article 24 letter A), b), d) Privacy Code and art.6 letter B) and c) GDPR), the data controller can communicate your data for the purposes in the article 2. A) to supervisory agencies, insurance societies, as well as those subjects for which the communication is mandatory by law to carry out the purposes above. The subjects above will send the data in their capacity of autonomous data controllers. Your data won’t be spread.
6. Data transfer
Personal data are stored into servers located, inside the European Union. It is understood, anyway, that the owner, when needed, will be entitled the move the servers also outside the EU. In this case the holder make sure as of now that the data transfer outside the EU will occur in accordance with the provisions of the relevant laws, prior the signature of the standard contractual terms required by the European Commission.
7. Character of data provisioning and consequences of the refusal to answer
It is clarified that with reference to the purposes in the sections 2 A of the paragraph “purposes of processing” in the absence of personal data about you and the related consent to the processing and except in cases in which the legislative decree 196/03 and the UE Regulation 2016/679 allow the provision following the consent, the provision won’t be allowed. The lack of the data transfer for the purposes mentioned in the sections 2B and 2C of the paragraph “Purposes of the processing” won’t have any consequence on the provision of the services.
8. Data subjects’ rights
In your capacity of data subject, you have the rights mentioned into the art. 7 Privacy Code and into the article 15 GDPR and precisely the rights of:
- Obtaining the acknowledgment of the existence or not of personal data concerning you even if not registered yet and their communication in an intelligible form;
- Obtaining the indication of: a) the origin of the personal data; b) the purposes and the processing arrangements; c) the approach applied in case of processing made with the help of electronic devices; d) the identification details of the data controller, of the responsible for the data processing and of the representative appointed in accordance with Article 5, indent 2 Privacy Code and art. 3, indent 1, GDPR; e) the subjects or the categories of subjects to which personal data can be communicated or that can become aware of them in their capacity of appointed representative into the State territory, of responsible for the data processing or of processor;
Obtaining: a) the updating, the adjustment or, when you have any interested, the data integration; b) the erasure, the transformation anonymously or the block of data processed infringing the law; including those whose conservation is unnecessary with regard to the purposes for which the data have been collected or processed later; c) the statement that the operations mentioned above on the letter a) and b) have been acquainted, also as regard their content, by those whose data have been communicated and spread, except the case in which this fulfilment it’s impossible or entails the use of resources clearly disproportionate compared to the right guaranteed;
Opposing in whole or in part a) for legitimate reasons to the processing of the personal data concerning you albeit concerning the purpose of the collecting; b) to the processing of personal data in order to submit advertising material or for direct sale or to undertake market researches or for commercial advertising using automated call systems without the intervention of an operator though e-mails and/or traditional marketing modes through telephone and/or paper mail. It is noted that the right of opposition of the subject involved, outlined in the previous section b) for activities of direct marketing through automated procedures can be extended to the traditional ones and that anyway it does not affect the possibility for the person involved to the right to object even only in part.
Consequently the person involved can decide to receive only communication through traditional procedures or only automated communications or either of those.
Where applicable, he has the rights mentioned in the art. 16-21 (Right of rectification, right to be forgotten, right to the limitation of processing, right of data portability, right of objection), as well as the right to lodge a complaint to the Competition Authority.
9. How to exercise your rights
You will exercise your right at any time sending a regsitered letter with proof of delivery to –My Style S.r.L with registered office in Via Vincenzo Monti,27 – 20123 Milano (MI), or an e-mail to privacy@mystylebags.it
10. Data controller, data responsible and processors appointed.
The data controller is My Style S.r.L with registered office in Via Vincenzo Monti,27– 20123 Milano (MI). The updated list f the people responsible and of the representatives is kept among the registered office of the processing holder.