Pursuant to Article 13 of Regulation (EU) 2016/679 (“GDPR”), Amitaly S.r.l. (“Amitaly”), as data controller, provides this notice on the processing of personal data collected from you. Appropriate technical and organisational measures are applied to protect the security and confidentiality of your data.
A) Controller
Amitaly S.r.l., registered office Corso Trieste 171, 00191 Roma (RM), Italy. Tax code and VAT no. 13913581008. Email: info@pellaria.it.
B) Purposes and legal bases
(i) Without consent: managing online accounts, orders, sales, deliveries, customer service, payments, returns and contacts, gift vouchers and discounts (performance of a contract or pre-contractual measures, Art. 6(1)(b) GDPR); administration, accounting and related legal obligations (Art. 6(1)(c) GDPR); protecting the website against abuse and fraud, defending legal claims, internal statistics and business analysis, and direct marketing of similar products to contact details given during a sale, which you may stop at any time (legitimate interest, Art. 6(1)(f) GDPR). Data marked as mandatory in forms is needed for these purposes; without it we cannot perform the contract.
(ii) With your consent (Art. 6(1)(a) and Art. 7 GDPR): marketing, newsletters and sales communications, and profiling for tailored promotions. Giving this data is optional and you may withdraw consent at any time, without affecting earlier processing. Automated tools may be used but no decision with legal effects on you is made solely by them.
C) Recipients
Your data may be accessed by staff authorised by the Controller and by providers acting as data processors, including website hosting (Hostinger), email and newsletter services (Mailchimp), anti-spam and security services (Google reCAPTCHA, Akismet), and, when active, payment providers and carriers. It may also be disclosed to professional advisers, banks and insurers where needed, and to judicial or supervisory authorities. Your data is not disseminated.
D) Transfers outside the EU
Some providers may process data outside the European Union. Such transfers take place only in compliance with Chapter V of the GDPR, for example on the basis of an adequacy decision or standard contractual clauses.
E) Retention
Data under B(i) is kept for the duration of the contractual relationship and then for the applicable limitation period, generally 10 years. Data under B(ii) is kept for no longer than 24 months for marketing and 12 months for profiling from your consent. After that it is deleted or anonymised.
Orders that are not paid (pending, failed or cancelled) are deleted automatically about one day after they are created, and customer accounts with no completed purchase are deleted after about one day of inactivity. Paid orders are kept for as long as accounting and tax law require.
F) Your rights
By writing to info@pellaria.it you may exercise your rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20) and objection (Art. 21), and withdraw consent. You may also lodge a complaint with the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma (www.garanteprivacy.it).
G) Minors
This website is not intended for children under 14, and we do not knowingly collect their data.