European Data Protection Regulation 2016/679 and Legislative Decree 196/2003 as last amended by Legislative Decree 101/2018

Introduction

This privacy policy will be constantly updated, also in consideration of future technological changes, purposes and/or guidelines of the European Supervisory Authorities and the European Committee, and the date of the last update will always be published.

1. Who processes your personal data?

The Data Controller is DISEGNO srl, VAT number 04664230234, with registered office in Via Pascoli 31, 37010 Affi (VR), legally represented by Martina Ferri Faggioli, who can be contacted at the following email address info.lucestudio@gmail.com, or by registered mail to the registered office.
Personal data will be processed by internal company personnel specifically authorized and designated as "Authorized Processors", periodically trained and updated on their roles, responsibilities, tasks and processing methods, and are under the direct control of the data controller.

2. Categories of subjects to whom data may be communicated or made known

Without prejudice to communications made in compliance with a legal obligation, regulation or current legislation, the communication, including through simple consultation or making available of your data, may occur to the following categories of subjects: natural or legal persons who provide specific services to our company for legal, administrative, tax and/or accounting consultancy, or credit recovery, maintenance, repair, installation, replacement or update services for electronic/IT devices.
The subjects indicated above will be appointed as data processors and must comply with the same high data protection conditions as applied by our company, as well as the same privacy regulations contained in this form.
We assure you that, in any case, only the necessary and relevant data will be transferred/communicated with respect to the purposes of the processing for which the individual data processors are responsible, and these latter subjects must respect the same conditions of confidentiality and data protection indicated in this policy.
Except for the cases indicated above, personal data will not be disseminated or communicated to third parties, unless with the prior and explicit consent of the data subject.

3. Source of personal data
All collected data are processed in compliance with current legislation and with due confidentiality.
The data in our possession are acquired directly through the completion of paper and/or digital contracts and concern, for example, the personal data of the sole proprietorship and/or the company name, address, tax code, VAT number, as well as any other data deemed useful by the Controller for the purpose of concluding and executing the contract.
Data processing occurs manually and automatically, on paper and digitally.

4. Nature of collection - refusal to communicate data

The request for personal data in the online forms on the shop.luce-studio.com website, necessary for requesting information and/or for establishing a commercial relationship, is optional, but the refusal of such communication by the data subject makes it impossible for the company to handle their request.
The collection of personal data through the contract (paper or digital) for the supply of goods is a contractual obligation and necessary to fulfill legal requirements (for example, in tax/accounting matters).
Failure by the data subject to communicate the data, as requested in the goods purchase contract, makes it impossible to conclude the contract.

5. Purpose and legal basis of processing
The collection or processing of personal data has the following purposes aimed at adequately carrying out our company's economic activity and, in particular, for:
a) exchange of pre-contractual information or information otherwise requested by the data subject;
b) administrative-fiscal and accounting management;
c) contractual execution;
d) retention of personal data for two years from the last contact with our company. For fiscally relevant documents and contracts signed by the client, retention is linked to the timeframe imposed by current law and in any case not less than ten years, unless disputes or claims will extend the retention period until their final resolution; at the end of the above-mentioned timeframe, the data will be definitively deleted and/or anonymized.
The processing of data based on a contract to which the data subject is a party and/or on a legal obligation does not require the explicit consent of the data subject.

6. Methods of processing, storage and destruction of personal data

Data processing will be carried out lawfully and fairly and in any case in compliance with the aforementioned legislation, using appropriate tools to guarantee its security and confidentiality and may also be carried out through automated and manual tools or through the use of software and/or digital technologies suitable for storing and managing the data itself.
Processing will be carried out, primarily, by the company's internal organization through its appointed personnel under the direction and control of the Data Controller.
Data will be stored in a form that allows the identification of the data subject for a period not exceeding that necessary for the purposes for which they are collected and processed, and will subsequently be destroyed.
In consideration of the particular nature of the contractual agreement, the Company undertakes and requires its collaborators to maintain confidentiality and not to communicate, disclose or disseminate to third parties information or news of which they have become aware during or as a consequence of the relationship.
Personal data will be processed in a manner that ensures adequate security, including protection, through appropriate technical and organizational measures such as, for example, the possible application of encryption, in order to prevent unauthorized or unlawful processing, loss, theft, accidental or malicious destruction or due to accidental damage, within the limits of diligence and the sector in question.
It should be noted that no particular and/or judicial data and data related to criminal offenses are processed.
Personal data may be stored for the terms indicated above in such a way as to allow their transfer to remote archives/servers located in Italy or within the European Union.

7. Right of Access

Pursuant to Article 13 of GDPR 679/2016, the data subject may contact our company, at the email address:

e-mail: office.lucestudio@gmail.com and will receive a response within 15 (fifteen) working days, to exercise the following rights:
Access/communication of personal data concerning you;
Obtain the update, rectification, erasure and/or restriction of the processing of your personal data;
Obtain the portability of your personal data on a structured, even digital, support, so that it can be easily transferred to another data controller;
Object, in whole or in part, to the processing of personal data; objection to automated processing includes objection to manual processing.
Right to lodge a complaint with the Supervisory Authority named Garante per la protezione dei dati, in ROME.


8. How can you object to processing? The data subject has the right to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her pursuant to GDPR 679/2016, Article 6(1)(e) or (f) on the basis of those provisions.
Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.
The objection does not affect the lawfulness of processing carried out in accordance with the regulations in force prior to the objection.