Privacy Policy

Your personal data is safe on viaroma60.it - Our data protection policy ensures that personal data is used exclusively for order management and thus for the shipment of ordered products, as well as for communications regarding orders, returns, cancellations, payments, and billing.
We also guarantee that the provided email addresses will never be disclosed to third parties but exclusively used for sending newsletters and promotions related to our business.

All data provided to VIA ROMA 60 on the website pages accessible at the internet address https://www.viaroma60.it at the time of registration and subsequently for the use of services provided by VIA ROMA 60 from time to time will be processed in compliance with the provisions of Legislative Decree 196/2003 on the protection of personal data (“Privacy Code”) and Article 13 of EU Regulation no. 2016/679 (hereafter, “GDPR”).

VIA ROMA 60, a brand of Gruppo Carillo S.p.A., CF and VAT 03192251217 (hereafter, “Data Controller”), as data controller, informs you pursuant to art. 13 of Legislative Decree 30.6.2003 no. 196 (hereafter, “Privacy Code”) and art. 13 of EU Regulation no. 2016/679 (hereafter, “GDPR”) that your data will be processed as follows:
 
1. Subject of the Processing
The Data Controller processes personal, identification data (e.g., name, surname, company name, address, phone, email, bank, and payment details) - hereafter, “personal data” or “data” - provided by you upon concluding contracts for the services of the Data Controller.
 
2. Purpose of the Processing
Your personal data are processed:
2.A) without your explicit consent (art. 24 lett. a), b), c) Privacy Code and art. 6 lett. b), e) GDPR), for the following Service Purposes:
- to conclude contracts for the services of the Data Controller;
- to fulfill pre-contractual, contractual, and tax obligations deriving from relationships with you;
- to comply with legal obligations, regulations, EU legislation, or an order from an Authority (e.g., in matters of anti-money laundering);
- to exercise the rights of the Data Controller, e.g., the right of defense in court;
- mandatory obligations for tax and accounting purposes;
- post-sales assistance;
- dispute management;
- customer management;
- quality management;
- activity scheduling;
- customer satisfaction assessment;
2.B) Only with your specific and distinct consent (art. 23 and 130 Privacy Code and art. 7 GDPR), for the following Marketing Purposes:
to send you, via email, postal mail, and/or SMS and/or telephone contacts, newsletters, commercial communications, and/or advertising materials on products or services offered by the Data Controller and assess the satisfaction with the quality of services;

Please note that if you are already our customer, we may send you commercial communications related to services and products similar to those you have already used, unless you object (art. 130 c. 4 Privacy Code).
The processing of data necessary to fulfill these obligations is essential for proper management of the relationship, and its provision is mandatory for implementing the purposes indicated above. The Data Controller also informs that any failure to communicate, or incorrect communication, of any required information may prevent the Data Controller from ensuring the proper handling of the processing.
All processing is carried out in accordance with the methods set out in articles 6, 32 of the GDPR, adopting the necessary security measures.

The confidentiality of the data provided by users is a fundamental prerogative of the company, which is committed to adopting the most appropriate measures to prevent the loss, appropriation, and disclosure of the user’s personal information, to prevent unauthorized uses.
To this end, the company is committed to constantly adopting and implementing all means and technologies aimed at protecting such information.

However, given the scope and complexity of web-connected IT systems, as well as the impossibility of guaranteeing complete protection of data transmissions, the company cannot ensure complete confidentiality of information received or sent through the server to the user.
By accepting this privacy policy, the user releases the company from any liability if the security system is breached.
 
3. Processing Methods
Your personal data are processed through the operations specified in art. 4 Privacy Code and art. 4 no. 2) GDPR, specifically: collection, recording, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, deletion, and destruction of data. Your personal data are processed both in paper and electronic and/or automated form.
The Data Controller will process personal data for the time necessary to fulfill the purposes mentioned above and, in any case, for no more than 10 years from the end of the relationship for Service Purposes and no more than 2 years from the data collection for Marketing Purposes.
 
4. Data Access
Your data may be made accessible for the purposes in art. 2.A) and 2.B):
- to employees and collaborators of the Data Controller, as persons in charge and/or internal data processors and/or system administrators;
- to third-party companies or other entities (such as banks, professional firms, consultants, etc.) performing outsourcing activities on behalf of the Data Controller as external data processors.
 
5. Data Communication
Without requiring explicit consent (ex art. 24 lett. a), b), d) Privacy Code and art. 6 lett. b) and c) GDPR), the Data Controller may communicate your data for the purposes in art. 2.A) to Supervisory Bodies (such as IVASS), judicial authorities, insurance companies for the provision of insurance services, and those entities required by law to perform the said purposes. These entities will process data as independent data controllers.
Your data will not be disseminated.
Your data will be communicated exclusively to competent persons duly appointed for the necessary services to manage the relationship, ensuring the protection of the rights of the data subject.
Your data will be processed solely by authorized personnel of the Data Controller, specifically in the following departments:
- Marketing Department
- Administration and Accounting Department
- Customer Service Department
- Programmers and Analysts
- Commercial Department
Your data may be communicated to duly appointed third-party Data Processors, specifically:
- Google Tag Manager: Analytics/Measurement, Content Personalization, Optimization;
- Couriers, Logistics companies, carriers;
- consultants and freelancers, even as a group;
- banks, credit institutions, online payment systems;
Disclosure: Your personal data will not be disclosed in any way.

6. Retention Period
Please note that, in compliance with the principles of lawfulness, purpose limitation, and data minimization, pursuant to art. 5 GDPR, the retention period of your personal data is:
- set for a period no longer than necessary to fulfill the provided services
- set for a period no longer than necessary to achieve the purposes for which they are collected and processed and in compliance with mandatory legal requirements
- set for a period no longer than necessary to achieve the purposes for which they are collected and processed for executing and fulfilling contractual purposes.
 
7. Cookie Management
If you have doubts or concerns about the use of cookies, you can always intervene to prevent their setting and reading, for example, by changing the privacy settings within your browser to block certain types of cookies.
Since each browser - and often different versions of the same browser - differ significantly, if you prefer to act independently through your browser preferences, you can find detailed information on the necessary procedure in your browser's help guide. For an overview of the actions required for the most common browsers, you can visit www.cookiepedia.co.uk.
Advertising companies also allow you to opt out of receiving targeted ads if desired. This does not prevent cookies from being set, but it stops the use and collection of some data by these companies.
For more information and options to opt out, visit www.youronlinechoices.eu/.
You have the right to obtain from the Data Controller the deletion (right to be forgotten), limitation, updating, rectification, portability, and objection to the processing of personal data concerning you, and in general, to exercise all the rights provided for in Articles 15, 16, 17, 18, 19, 20, 21, 22 of the GDPR.

8. Data Transfer
Personal data are stored on servers located within the European Union. In any case, the Data Controller reserves the right, if necessary, to transfer the servers outside the EU. In such cases, the Data Controller assures that the transfer of data outside the EU will comply with applicable legal provisions, subject to the conclusion of the standard contractual clauses provided by the European Commission.

9. Nature of Data Provision and Consequences of Refusal to Respond
The provision of data for the purposes mentioned in art. 2.A) is mandatory. In their absence, we cannot guarantee the Services in art. 2.A).
The provision of data for the purposes mentioned in art. 2.B) is optional. You may, therefore, decide not to provide any data or later deny the possibility of processing data already provided: in this case, you will not receive newsletters, commercial communications, and advertising material related to the services offered by the Data Controller. However, you will continue to be entitled to the Services referred to in art. 2.A).

10. Rights of the Data Subject
As a data subject, you have the rights under art. 15 GDPR, namely the right to:
1. obtain confirmation of whether or not personal data concerning you exist, even if not yet recorded, and their communication in an intelligible form;
2. obtain information on the origin of personal data, processing purposes and methods, logic applied in case of processing with the aid of electronic instruments, identification details of the Data Controller, data processors, and designated representatives pursuant to art. 5, paragraph 2 of the Privacy Code and art. 3, paragraph 1, GDPR, entities or categories of entities to whom personal data may be communicated or who may become aware of it as designated representatives within the State's territory, data processors, or persons in charge;
3. obtain:
a) updating, rectification, or, when interested, integration of data;
b) deletion, anonymization, or blocking of data processed unlawfully, including data whose retention is unnecessary for the purposes for which they were collected or subsequently processed;
c) certification that the operations under letters a) and b) have been notified, also as regards their content, to those to whom the data have been communicated or disseminated, except in cases where this proves impossible or involves a manifestly disproportionate use of means with respect to the protected right;
4. object, in whole or in part:
a) for legitimate reasons, to the processing of personal data concerning you, even if pertinent to the collection purpose;
b) to the processing of personal data concerning you for sending advertising or direct sales material or for market research or commercial communications, through the use of automated call systems without operator intervention via email and/or through traditional marketing methods via phone and/or postal mail.
Where applicable, you also have the rights referred to in Articles 16-21 GDPR (Right to rectification, right to be forgotten, right to limitation of processing, right to data portability, right to object), as well as the right to complain to the Authority.
 
11. How to Exercise Your Rights
You can exercise your rights at any time by sending:
a registered letter to Gruppo Carillo S.p.A. Via S. Leonardo Trav. Migliaro, 80 (SA);
or an email to privacy@gruppocarillo.com.