CHIARA PROVASI s.r.l., with VAT number IT 11046690969, and with registered office in Meda (Province of Monza and Brianza) at the address of Viale Trieste snc (e-mail: info@chiaraprovasi.com) , as the Controller of your personal data, pursuant to and for the purposes of Regulation (EU) 2016/679 (the “GDPR”), hereby informs you that we shall process your personal data in accordance with the principles of fairness, lawfulness, transparency and minimisation, within the provisions of the legislation cited above and with the confidentiality obligations provided for therein.

1. Categories of Personal data processed

The Controller shall process the personal identification and contact details (such as name, surname, address, telephone number and e-mail address) (the “Data” or “Personal Data”) communicated by you upon your having entered into agreements or participated in promotional events or activities organised by the Controller.

2. Purposes and Legal Basis for Processing

Your data shall be processed for the purposes of informing you of the staging of promotional events and/or activities concerning the products and/or services provided by the Controller (furniture and design items, furniture fittings and related accessories under the CHIARA PROVASI brand – hereinafter the "Products").

The legal basis for such processing is the legitimate interest of the Data Controller (Article 6(1)(f) of the GDPR), which has received your data from you (and has received your interest in the Products) and therefore has reason to believe that you are interested in receiving invitations and news regarding the Products or regarding Controller-promoted events and/or activities regarding the world of design/furniture.

Your data are provided voluntarily. Nevertheless, failure to submit Data or the submission of erroneous Data shall prevent the Controller from conducting its invitational and/or promotional activities.

3. Data Processing Procedure

Personal Data shall be treated automatically and/or manually, in accordance with the Art. 32 of the GDPR, by adopting the appropriate security measures and, above all, by observing the principles of lawfulness, fairness, transparency, purpose limitation, minimisation, completeness and privacy.

Specific security measures shall be observed in order to prevent unauthorized access, loss, misappropriation and misuse of the Data.

4. Recipients or categories of recipients of Personal Data

​

We inform you that your Personal Data shall not be disseminated, transferred to third parties or otherwise communicated without your explicit consent, other than for any communication necessary for the fulfilment of the purpose stated above.

In particular, we inform you that your Personal Data may be communicated to:

Trained and authorised workers and/or employees of the Controller, where this falls under their duties;

IT service providers and the company that organises the event invitation service.

An updated list of the Data Processors engaged by the Controller pursuant to Art. 28 of Regulation (EU) 679/2016 shall be available at the registered office of the Controller.

The Controller may communicate your identification details to Supervisory Bodies and Judicial Authorities, and all other entities to which communication of same is required by law, without having received your explicit consent to do so.

5.  Transfer of Personal Data outside the EU and Personal Data Retention Period

Your Personal Data shall not be transferred to countries outside the EU and your Data will be retained for a period of 5 years.

6. Rights of the Data Subject

 Your rights under the GDPR shall include:

The right to request access to your Personal Data and information relating to your Personal Data; The right to update Data, rectify inaccurate Data or have incomplete Data completed; The right to erase the Personal Data regarding you (upon the occurrence of any of the conditions indicated in Art. 17(1) of the GDPR and in compliance with the exceptions provided for in Art. 17(3) thereof); The right to restrict the processing of your Personal Data (upon the occurrence of any of the assumptions indicated in Art. 18(1) of the GDPR);

The right to request and obtain from the Controller - where the legal basis for processing is an agreement or consent, and where the Data is processed automatically - your Personal Data in a structured, machine-readable format, including for the purpose of forwarding the Data to another Controller (the right to data portability);

The right to object to the processing of your Personal Data at any time in the event of special circumstances in your regard;

The right to withdraw your consent at any time, only where the basis for the processing is your own consent for one or more specific purposes and only where the processing concerns common Personal Data (such as date and place of birth, or place of residence) or particular Data categories (such as Data revealing your racial origin, your racial origin, your political opinions, your religious beliefs, your health or your sex life). However, any processing carried out on the basis of your consent, prior to the withdrawal of your consent, shall remain lawful;

The right to lodge a complaint with a supervisory authority (the Authority for the Protection of Personal Data - www.garanteprivacy.it) or to lodge an appeal before the Judicial Authority in accordance with Art. 140-bis of the Italian Privacy Code and subsequently Italian Legislative Decree 101/201.8

You may exercise your rights by sending an email to info@chiaraprovasi.com or a letter to the following address:

Chiara Provasi, via Trieste snc, 20821 Meda MB Italia.