Privacy Policy

This information relates to the data processing carried out by Mazal Srl, with headquarters in Via Egadi, 7, 20144 Milan (MI – Italy), VAT no. 12911360969, with tax code 1 2911360969 , email customers@mazalsrl.com (hereinafter the “ Data Controller ”), also in compliance with EU Regulation 2016/679 (hereinafter “GDPR”).

The Data Controller, in fact, may process personal data relating to customers and suppliers, agents, consultants, whether they are interested parties and/or contractors, as defined by current legislation on personal data.

DEFINITIONS «Personal Data» : means any information relating to an identified or identifiable natural person ( «Data subject» ). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more elements characteristic of his physical identity, physiological, genetic, psychological, economic, cultural or social. Personal data subjected to Pseudonymisation, which could be attributed to a natural person through the use of additional information, should be considered Personal Data. «Data Controller» : means the natural or legal person who processes Personal Data on behalf of the Data Controller. «Data controller» : means the natural or legal person who, individually or together with others, determines the purposes and means of the processing of Personal Data. «Processing» : means any operation or set of operations, carried out with or without the aid of automated processes and applied to Personal Data or sets of Personal Data, such as collection, recording, organisation, structuring, storage , adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other form of making available, comparison or interconnection, limitation, cancellation or destruction.

1. IDENTITY AND CONTACT DATA OF THE DATA CONTROLLER
   The data controller is Mazal Srl
   Since the Data Controller is established in Italian territory, no representative has been appointed.
2. PURPOSE OF THE PROCESSING AND LEGAL BASIS OF THE PROCESSING
   Personal data will be processed for the following purposes:
   to. for contractual purposes and, in particular, to allow the purchase of services and products through the Owner's E-commerce. In this case, the need to proceed with processing for the purpose of executing the contract constitutes the legal basis. The communication of personal data constitutes an obligation on the part of the interested parties; in case of failure to communicate such data, however, it will not be possible to conclude any contract;
   b. to send direct marketing communications, newsletters, advertising material, by means of traditional contact systems and automated IT systems, including commercial or promotional communications by email or SMS, or for market research and analysis. In this case, consent, expressed in accordance with this information, constitutes the legal basis;
   c. for activities of determining habits and preferences through profiling treatments. In this case, the consent of the interested party, expressed in accordance with this information, constitutes the legal basis. In relation to the personal data processed, the communication of personal data is not a contractual obligation. The interested party has the right to provide personal data; in case of failure to communicate such data, however, it will not be possible to carry out any profiling activity;
   d. for purposes related to related legal obligations, in this case the legal basis is the legal obligation of the Data Controller to process such personal data in compliance with applicable national legislation.
3. METHOD OF EXPRESSING CONSENT
   Consent, where required, may be expressed by signing a computerized document, also via specific flagboxes.
4. PROCESSING METHOD AND LOGIC
   - In relation to the personal data processed for the purposes referred to in point a) number 2 of this information (contractual and pre-contractual purposes) the processing will take place through automated logic and use of CRM type management software which will allow the fulfillment to be managed in the best possible way. of contractual obligations;
   - In relation to the personal data processed for the purposes referred to in point b) number 2 of this information (marketing purposes) the processing will be carried out using software for sending commercial information.
   - In relation to personal data processed for the purposes referred to in point c) number 2 (profiling), the processing will take place via CRM which allows you to define tastes and preferences in order to offer personalized services and communications. For further details see the next point.
   - In relation to the personal data processed and stored for the purposes referred to in point d), number 2 (legal purposes), the processing will take place using paper-based tools, automated logic and use of CRM-type management software which will allow for better management the fulfillment of contractual obligations.
5. AUTOMATED DECISION MAKING AND PROFILING
   In the event that the interested party provides his/her consent to the processing of personal data for the purpose of using personalized services through profiling, the same may be subject to an automated decision-making process, using a specific algorithm that will decide which communications are most suitable for his/her needs. profile or which ones might be of most interest. The processing carried out in this way has, as expected consequences, for example, the sending of highly profiled commercial communications, the sending of discounts, the sending of invitations to events deemed of interest, etc.
   The interested party has, in any case, the right to obtain human intervention in the decision-making process by the Data Controller, to express his/her opinion, to obtain an explanation of the decision reached and to contest the decision itself, in compliance with the art. . 22 GDPR.
6. SOURCE FROM WHICH THE PERSONAL DATA ORIGINATES
   Only the data provided in accordance with this information will be processed. Personal data from sources accessible to the public will not be processed.
7. RECIPIENTS AND ANY CATEGORIES OF RECIPIENTS OF PERSONAL DATA
   The following may be recipients of personal data:
   - communications companies that carry out commercial communication activities and profiling activities on behalf of the Data Controller, if the relevant consent has been expressed, which hold the status of data controllers;
   - companies offering information society services, including, in particular, those offering hosting services;
   - companies that carry out statistical and market surveys, if the relevant consent has been expressed;
   - auditing companies;
   - the Data Controller's partner companies;
8. DATA CATEGORIES
   Personal data will be processed. In no case may particular data be processed pursuant to art. 9 of the GDPR.
9. DATA TRANSFER
   The Data Controller intends to transfer the personal data to a third country or to an international organisation. These subjects could be represented, by way of example, by:
   - communications companies that carry out communication activities on behalf of the Data Controller;
   - communications society service providers;
   - controlled and/or controlling organisations.
   The transfer of personal data to such subjects, if established in a third country or an international organisation, is carried out in the presence of an adequacy decision from the European Commission, which has verified that the third country, the territory or one or more specific sectors within the third country, or the international organization in question ensure an adequate level of protection of rights. In any case, the Data Controller - if the latter deems it appropriate - reserves the right to conclude specific separate agreements which oblige such subjects to adopt adequate security measures, including organizational ones, aimed at offering appropriate guarantees regarding rights. The data may thus be transferred to the following countries: United States of America. To obtain a copy of such data or the place where they were made available, simply send the relevant request to the Data Controller, at the addresses in the epigraph.
10. PERIOD OF CONSERVATION OF PERSONAL DATA
    - The personal data processed and stored for the purposes referred to in point a) and d), number 2 (contractual and pre-contractual purposes and fulfillment of legal obligations) are processed and stored in accordance with the provisions of current legislation and, in any case, for a period of time not exceeding 10 years starting from the termination of the effects of the contract in the event of its conclusion, unless otherwise required by law;
    - The personal data processed for the purposes referred to in point b) number 2 of this information (marketing purposes) are processed and stored until the relevant cancellation and/or revocation is requested by the interested party
    - Personal data processed for the purposes referred to in point c) number 2 (purpose of determining preferences) are processed and stored for a period of time not exceeding 12 months from collection.
11. RIGHT OF CONSENT AND CONSEQUENCES OF FAILURE TO CONSENT
    - In relation to personal data processed for the purposes referred to in point a) number 2 of this information (contractual and pre-contractual purposes), the communication of personal data constitutes an obligation; in case of failure to communicate such data, it will not be possible to conclude any contract.
    - In relation to personal data processed for the purposes referred to in point b) number 2 of this information (marketing purposes), the communication of personal data is not a contractual obligation. You have the right to provide personal data; in case of failure to communicate such data, however, it will not be possible to carry out any marketing activity.
    - In relation to personal data processed for the purposes referred to in point c) number 2 of this information (purpose of determining preferences), the communication of personal data is not a contractual obligation. The interested party has the right to provide personal data; in case of failure to communicate such data, it will not be possible to carry out any profiling activity.
    - In relation to personal data processed for the purposes referred to in point d) number 2 of this information (legal obligations), the communication of personal data is a legal obligation.
12. RIGHT TO OBJECT
    The interested party has the right to object in the following terms:
    - the right to object at any time, for reasons related to your particular situation, to the processing of personal data concerning you pursuant to Article 6, paragraph 1, letters e) or f) of the GDPR. The Data Controller refrains from further processing the personal data unless he demonstrates the existence of compelling legitimate reasons to proceed with the processing which prevail over the interests, rights and freedoms of the interested party or for the assessment, exercise or defense of a right in court;
    - if personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you carried out for such purposes, including profiling to the extent that it is connected to such direct marketing;
    - in case of opposition to the processing for direct marketing purposes, the personal data are no longer processed for these purposes. It is specified that the interested party's right to object to the processing of their personal data for the aforementioned purposes may be exercised even only in part, i.e. by objecting, for example, to the sole sending of promotional communications carried out via automated and/or digital tools, or to the sending of paper communications;
    - if personal data are processed for scientific or historical research purposes or for statistical purposes pursuant to Article 89, paragraph 1 of the GDPR, the interested party, for reasons related to his particular situation, has the right to object to the processing of data personal data concerning you, except where processing is necessary for the performance of a task in the public interest.
13. OTHER RIGHTS
    The Data Controller also intends to inform you of the existence of the following rights:
    - Right of access: the interested party has the right to obtain confirmation from the Data Controller as to whether or not personal data concerning him or her are being processed and, in this case, to obtain access to the personal data and specific information, in compliance with the art. 15 of the GDPR;
    - Right of rectification: the interested party has the right to obtain from the Data Controller the rectification of inaccurate personal data concerning him or her without unjustified delay. Taking into account the purposes of the processing, the interested party has the right to obtain the integration of incomplete personal data, also by providing a supplementary declaration, in accordance with the art. 16 of the GDPR;
    - Right to delete data, including the right to withdraw consent: the interested party has the right to obtain from the Data Controller the deletion of personal data concerning him/her without unjustified delay and the Data Controller has the obligation to delete the personal data without unjustified delay, or to revoke his/her consent, if the reasons defined by the Data Controller exist. 'art. 17 of the GDPR. As regards the right to revocation, the interested party also has the right to revoke consent at any time without prejudice to the lawfulness of the processing based on the consent given before the revocation;
    - Right to restriction of processing: the interested party has the right to obtain from the Data Controller the limitation of processing when the hypotheses defined by the art. 18 of the GDPR;
    - Right to data portability: the interested party has the right to receive in a structured format, commonly used and readable by automatic device, the personal data concerning him/her provided to the Data Controller and has the right to transmit such data to another data controller without impediments by the Data Controller in the cases and under the conditions specified by the art. 20 of the GDPR;
    - Contractor's right to object to commercial communications: the contractor has the right to object at any time, free of charge, to the receipt of commercial communications.
14. EXERCISE OF RIGHTS
    Requests to exercise the rights indicated in this information, including, in particular, the right to cancellation and the right to revoke the consent given must be addressed directly to the Data Controller at the email address customers@mazalsrl.com . Alternatively, you can exercise your rights by sending the relevant communication via registered letter with return receipt addressed to Mazal Srl at the address Via Egadi 7, 20144 Milan (MI), Italy.
15. ACCESSIBILITY OF THE INFORMATION
    The information is accessible from the Owner. If expressly requested, the information can also be provided orally, provided that the identity of the requester is proven, by means of a telephone request addressed to the addresses of the Data Controller.
16. CHANGES
    The Data Controller may make changes to this privacy policy, also in order to implement changes in national and/or community legislation, to adapt to technological innovations or for other reasons. Any new versions of this privacy policy will be reported on the Site. The interested party is therefore invited to periodically check the privacy policy. Any modification will in any case be communicated to interested parties (users) through pop-ups on the site or through different IT methods/tools. In the event that substantial changes are made to this privacy policy with a change in the processing purposes and/or categories of data processed, the Data Controller will inform the interested party, requesting the consent necessary for this purpose.