Privacy

IN  THE  FIELD  OF  PROTECTION  OF  PERSONAL  DATA  PURSUANT  TO  ART.  12  and  ss.  EU
REGULATION  679/

Pursuant  to  the  new  EU  Regulation  679/2016,  in  accordance  with  the  principle  of  accountability  any processing of personal data must be lawful and  correct. The manner in which the personal data concerning  him  is  collected,  consulted  or  otherwise  treated,  as  well  as  the  extent  to  which  the  same data  is  or  will  be  treated  must  be  transparent  to  individuals. The principle of transparency requires that information and communications relating to the processing  of  such  data  are  easily  accessible  and  comprehensible  and  that  simple  and  clear  language is  used. This  principle  concerns,  in  particular,  the  information  of  the  interested  parties  on  the  identity  of  the Data  Controller  and  the  purposes  of  the  processing  and  additional  information  (see  Articles  13  and 14 of EU Regulation 679/2016) to ensure correct and transparent treatment with regard to the natural persons concerned and their rights to obtain confirmation and communication of the processing of personal data concerning them (on the point of see Recital 39, EU Regulation 679/2016). With  this  in  mind,  please  read  the  following  information. Stella  Srl  based  in  Via  Roma,  34  -­‐ Montecarlo  -­‐ Lucca  -­‐ Italy, VAT  number   address  pec  stellasrl2015@pec.it  email  address:  privacy@ruedesmille.com  and New  Gold  Srl  with  registered  office  in  Via  dei  Mille,  99  -­‐ La  Spezia  -­‐ Italy, VAT  number  00293480117,  Tel./Fax  0583. pec  address  newgoldsrl@pec.it  -­‐ email  address:  privacy@ruedesmille.com, acting  as  data  controllers  pursuant  to  and  for  the  effects  of  EU  Regulation  2016/679  ,  hereby  inform the  interested  party  that  the  personal  data  assumed  concerning him,  acquired  by  the  Co-­‐owner or that  will  be  requested  later  and  /  or  communicated  by  third  parties,  will  be  used  for  the  purposes indicated  below.

PURPOSE  AND  LICENSE  OF  TREATMENT Pursuant  to  EU  Regulation  679/2016,  personal  data: -­‐ They  are  treated in  a  lawful,  correct  and  transparent  way  towards  the  interested  party  (Article  5); -­‐ The  same  are  collected  for  specific,  explicit  and  legitimate  purposes,  and  subsequently  processed in  a  way  that  is  not  incompatible  with  these  purposes  (Article  5); The  purposes  for  which  the  data  are  collected  are  as  follows:

• comply with any legal obligations related to civil, fiscal, accounting, etc. for the purposes of

administrative management of the relationship you may have established with Stella Srl or New Gold  Srl  as  well  as  for  our  legal  protection;

• fulfill contractual obligations, delivery / return of goods, technical support and technical

information,  after-­‐sales  assistance  and  verification  of  satisfaction  with  the  products  of  interest  to you;

• to satisfy market and statistical inquiries to carry out marketing, to send offers, with regard to

products  subject  to  the  activity  of  Stella  Srl  or  New  Gold  Srl;

• for the communication / forwarding of commercial information on initiatives, product

announcements, services  and  offers,  brochures,  by  Stella  Srl  or  New  Gold  Srl  by  sending  e-­‐mails, newsletters,  text  messages  and  even  paper  by  mail.

PROCESSING  METHOD  AND  CONFIDENTIALITY  OBLIGATION

The  processing  of  data  is  performed  through  computer  tools  and  /  or  paper,  by  persons  committed to confidentiality, with logic related to the purposes and in any way to ensure the security and confidentiality of data. They will be the subject of automated treatment through software, management  and  other  programs  that  help  us  in  the  treatment  and  execution  of  the  activities  listed above  including  marketing.

COMMUNICATION  TO  THIRD  PARTIES Your personal data may be disclosed to third parties known to us only and exclusively for the aforementioned  purposes  and,  in  particular,  to  the  following  categories  of  subjects: -­‐ External  companies  that  perform  services  on  our  behalf; -­‐ Entities  and  Public  Administrations  for  legal  obligations; -­‐ Professionals  who  can  support  the  fulfillment; -­‐ Providers of services / products, for example, to process  credit card and payment data, shipments, deliveries, hosts, to manage data, to forward e-­‐mails, to manage product promotion,  for  research  and  analysis,  as  well  as  administer  certain  services; When  we  communicate  data  to  third  parties  we  enter  into  agreements  that  require  them  to  ensure that  they  take  technical  and  organizational  measures  to  protect  personal  data.  These  subjects  will process  personal  data  as  external  managers.

STORAGE  TIME

Pursuant  to  art.  5  of  EU  Regulation  679/2016, "Principles  relating  to  processing  of  personal  data”, personal  data  are  stored  in  a  form  that  allows  identification  of  data  subjects  for  a  period  of  time  not exceeding  the  achievement  of  the  purposes  for  which  they  are  processed. The  personal  data  of  the  interested  parties  may also  be  kept  for  longer  periods  in  compliance  with the  requirements  relating  to  the  laws  in  force  (by  way  of  example  regarding  accounting)  and,  in  any case, applying every technical-­‐organizational measure suitable to activate mechanisms of anonymization  of  the  data  . The data will be stored for a period of time not exceeding the achievement of the purposes and interests  for  which  they  are  processed  and  will  be  promptly  deleted  at  the  request  simply  by  writing to  privacy@ruedesmille.com

RIGHTS  OF  THE  INTERESTED  PARTY Pursuant to current legislation, the interested party may assert their rights to each of the data processing  contractors  (also  using  the  downloadable  template Http://ruedesmille.com/unsubscribe.pdf),  as  expressed  in  EU  Regulation  679/2016,  ie  :

Right  of  access  by  the  data  subject
Art.  

1. The  data  subject  shall  have  the  right  to  obtain  from  the  controller  confirmation  as  to  whether or  not  personal  data  concerning  him  or  her  are  being  processed,  and,  where  that  is  the  case, access  to  the  personal  data  and  the  following  information: 1. the  purposes  of  the  processing; 2. the  categories  of  personal  data  concerned; 3. the  recipients  or  categories  of  recipient  to  whom  the  personal  data  have  been  or  will be  disclosed,  in  particular  recipients  in  third  countries  or  international  organisations;

2. where  possible,  the  envisaged  period  for  which  the  personal  data  will  be  stored,  or, if  not  possible,  the  criteria  used  to  determine  that  period;

3. the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject  or  to  object  to  such  processing;

4. the  right  to  lodge  a  complaint  with  a  supervisory  authority;

5. where the personal data are not collected from the data subject, any available information  as  to  their  source;

6. the  existence  of  automated  decision-­‐making,  including  profiling,  referred  to  in Article 22 (1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing  for  the  data  subject.

7. Where  personal  data  are  transferred  to  a  third  country  or  to  an  international  organisation,

the  data  subject  shall  have  the  right  to  be  informed  of  the  appropriate  safeguards  pursuant to Article  46 relating  to  the transfer. 3. 1 The controller shall provide a copy of the personal data undergoing processing.  2 For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs.  3 Where the data subject makes the  request by electronic means, and unless otherwise requested by the data subject, the information shall be provided  in  a  commonly  used  electronic  form. 4. The  right  to  obtain  a  copy  referred  to  in  paragraph  3  shall  not  adversely  affect  the  rights  and freedoms  of  others.

RIGHT  TO RECTIFICATION
art.  

The data subject shall have the right to obtain from the controller without undue delay the rectification  of  inaccurate  personal  data  concerning  him  or  her.  2 Taking  into  account  the  purposes of  the  processing,  the  data  subject  shall  have  the  right  to  have  incomplete  personal  data  completed, including  by  means  of  providing  a  supplementary  statement.

Right  to  erasure  (‘right  to  be  forgotten’)
Art.  

1. The  data  subject  shall  have  the  right  to  obtain  from  the  controller  the  erasure  of  personal data  concerning  him  or  her  without  undue  delay  and  the  controller  shall  have  the  obligation to  erase  personal  data  without  undue  delay  where  one  of  the  following  grounds  applies: 1. the  personal  data  are  no  longer  necessary  in  relation  to  the  purposes  for  which  they were  collected  or  otherwise  processed; 2. the  data  subject  withdraws  consent on  which  the  processing  is  based  according  to point  (a)  of Article  6(1),  or  point  (a)  of Article  9(2),  and  where  there  is  no  other  legal ground  for  the  processing; 3. the  data  subject  objects  to  the  processing  pursuant  to Article  21(1)  and  there  are  no overriding  legitimate  grounds  for  the  processing,  or  the  data  subject  objects  to  the processing  pursuant  to Article  21(2); 4. the  personal  data  have  been  unlawfully  processed; 5. the  personal  data  have  to  be  erased  for  compliance  with  a  legal  obligation  in  Union or  Member  State  law  to  which  the  controller  is  subject;

2. the  personal  data  have  been  collected  in  relation  to  the  offer  of  information  society services  referred  to  in Article  8(1).

3. Where the controller has made the personal data public and is obliged pursuant to

paragraph 1 to erase the personal data, the controller, taking account of available technology  and  the  cost  of  implementation,  shall  take  reasonable steps,  including  technical measures,  to  inform  controllers  which  are  processing  the  personal  data  that  the  data  subject has  requested  the  erasure  by  such  controllers  of  any  links  to,  or  copy  or  replication  of,  those personal  data. 3. Paragraphs  1  and  2  shall not  apply  to  the  extent  that  processing  is  necessary:

1. for  exercising  the  right  of  freedom  of  expression  and  information;
2. for  compliance  with  a  legal  obligation  which  requires  processing  by  Union  or  Member

State  law  to  which  the  controller  is  subject  or  for  the  performance  of  a  task  carried out in the public interest or in the exercise of official authority vested in the controller; 3. for  reasons  of  public  interest  in  the  area  of  public  health  in  accordance  with  points (h)  and  (i)  of Article  9(2)  as  well  as Article  9(3); 4. for  archiving  purposes  in  the  public  interest,  scientific  or  historical  research  purposes or  statistical  purposes  in  accordance  with Article  89(1)  in  so  far  as  the  right  referred to  in  paragraph  1  is  likely  to  render  impossible  or  seriously  impair  the  achievement of  the  objectives  of  that  processing;  or 5. for  the  establishment,  exercise  or  defence  of  legal  claims.

Right  to  restriction  of  processing
Art.

1. The  data  subject  shall  have  the  right  to  obtain  from  the  controller  restriction  of  processing where  one  of  the  following  applies: 1. the accuracy of the personal data is contested by the data subject,  for a period enabling  the  controller  to  verify  the  accuracy  of  the  personal  data; 2. the  processing  is  unlawful  and  the  data  subject  opposes  the  erasure  of  the  personal data  and  requests  the  restriction  of  their  use  instead; 3. the  controller  no  longer  needs  the  personal  data  for  the  purposes  of  the  processing, but  they  are  required  by  the  data  subject  for  the  establishment,  exercise  or  defence of  legal  claims; 4. the data subject has objected to processing pursuant to Article 21(1) pending the verification  whether  the  legitimate  grounds  of  the  controller  override  those  of  the data  subject.
2. Where  processing  has  been  restricted  under  paragraph  1,  such  personal  data  shall,  with  the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another  natural  or  legal  person  or  for  reasons  of  important  public  interest  of  the  Union  or  of a  Member  State.
3. A  data  subject  who  has  obtained  restriction  of  processing  pursuant  to  paragraph  1  shall  be informed  by  the  controller  before  the  restriction  of  processing  is  lifted.

Right  to  data  portability
Art.

1. The data subject shall have  the right to receive the personal data concerning him or her, which  he  or  she  has  provided  to  a  controller,  in  a  structured,  commonly  used  and  machine-­‐ readable format and have the right to transmit those data to another controller without hindrance  from  the  controller  to  which  the  personal  data  have  been  provided,  where: 1. the  processing  is  based  on  consent  pursuant  to  point  (a)  of Article  6(1)  or  point  (a) of Article  9(2)  or  on  a  contract  pursuant  to  point  (b)  of Article  6(1);  and 2. the  processing  is  carried  out  by  automated  means.
2. In  exercising  his  or  her  right  to  data  portability  pursuant  to  paragraph  1,  the  data  subject shall  have  the  right  to  have  the  personal  data  transmitted  directly  from  one  controller  to another,  where  technically  feasible.
3. 1 The  exercise  of  the  right  referred  to  in  paragraph  1  of  this  Article  shall  be  without  prejudice to Article 17.  2 That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
4. The right referred to in paragraph 1 shall not adversely affect the rights and freedoms of others.

Right  to  object
Art.  

1. 1 The  data  subject  shall  have  the  right  to  object,  on  grounds  relating  to  his  or  her  particular situation,  at  any  time  to  processing  of  personal  data  concerning  him  or  her  which  is  based on point (e) or (f) of Article 6(1), including profiling based on those provisions.  2 The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms  of  the  data  subject  or  for  the  establishment,  exercise  or  defence  of  legal  claims.
2. Where personal data are processed for direct marketing purposes, the data subject shall have  the  right  to  object  at  any  time  to  processing  of  personal  data  concerning  him  or  her  for such marketing, which includes profiling to the extent that it is related to such direct marketing.
3. Where  the  data  subject  objects  to  processing  for  direct marketing purposes,  the personal data  shall  no  longer  be  processed  for  such  purposes.
4. At  the  latest  at  the  time  of  the  first  communication  with  the  data  subject,  the  right  referred to  in  paragraphs  1  and  2  shall  be  explicitly  brought  to  the  attention  of  the  data  subject  and shall  be  presented  clearly  and  separately  from  any  other  information.
5. In the context of the use of information society services, and notwithstanding Directive 2002/58/EC,  the  data  subject  may  exercise  his  or  her  right  to  object  by  automated  means using  technical  specifications.
6. Where  personal  data  are  processed  for  scientific  or  historical  research  purposes  or  statistical purposes pursuant to Article 89(1), the data subject, on grounds relating to his or her particular  situation,  shall  have  the  right  to  object  to  processing  of  personal  data  concerning him  or  her,  unless  the  processing  is necessary  for  the  performance  of  a  task  carried  out  for reasons  of  public  interest.

In  addition  to  the  aforementioned  rights,  the  interested  party  has  the  right  to  revoke  the  consent upon  an  appropriate  request,  as  well  as  to  lodge  a  complaint  with  the  Supervisory  Authority  for  the

protection of personal data  -­‐ website: http://www.garanteprivacy.it  -­‐ email address: guarantor @ gpdp .com.

CO-­‐OWNER  OF  DATA  AND  PRIVACY  COMMUNICATIONS Stella  Srl  based  in  Via  Roma,  34  -­‐ Montecarlo  -­‐ Lucca  -­‐ Italy, VAT  number  02383 430465 address  pec  stellasrl2015@pec.it  email  address:  privacy@ruedesmille.com  and New  Gold  Srl  with  registered  office  in  Via  dei  Mille,  99  -­‐ La  Spezia  -­‐ Italy, VAT  number  00293480117,  Tel./Fax  0583.

FOR FURTHER INFORMATION also in relation  to the methods of exercising these rights and any communication  we  are  at  your  disposal. Tel./Fax  0583. Email  address:  privacy@ruedesmille.com