Privacy & Security

Fabbri 1905 S.p.A. (hereinafter, “Fabbri”) is committed to protecting the online privacy of users interacting with the website https://shop.fabbri1905.com/ (hereinafter, “Website”). Without prejudice to the possible coexistence of local laws and regulations applicable to websites in foreign countries, this Privacy Policy has been drafted, pursuant to Articles 13 and 14 of the EU Regulation 2016/679 (hereinafter, the "Regulation"), in order to inform you about the ways in which your personal data will be processed when using the Website. This Privacy Policy will also provide you with the necessary information to enable you to consent to the processing of your personal data in an explicit and informed manner, where appropriate.
***
The processing of your personal data will be based on the principles of fairness, lawfulness, transparency, purpose limitation and storage limitation, minimisation, accuracy, integrity and confidentiality, as well as on the principle of accountability pursuant to Article 5 of the Regulation. Your personal data will therefore be processed in accordance with the legal provisions of the Regulation and the confidentiality obligations set out therein. Processing of personal data shall mean any operation or set of operations which is performed upon personal data or sets of personal data, whether or not by automatic means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.


Summary

1. OWNER AND DATA PROTECTION OFFICER

2. PERSONAL DATA BEING PROCESSED

  • Navigation data
  • Data voluntarily provided by the user
  • Data processed on account of services rendered online
  • Cookies

3. PURPOSE OF THE PROCESSING

4. LEGAL BASIS AND MANDATORY OR OPTIONAL NATURE OF PROCESSING

5. DESTINATARI DEI DATI PERSONALI

6. TRANSFERS OF PERSONAL DATA

7. STORAGE OF PERSONAL DATA

8. RIGHTS OF THE DATA SUBJECT

9. CHANGES

10. CONTACTS



1. OWNER AND DATA PROTECTION OFFICER

The data controller is Fabbri 1905 S.p.A., with registered office at Via Emilia Ponente, 276 40132 - Bologna, Italy (hereinafter referred to as the "Data Controller" or "Fabbri"), which can be reached at the e-mail address privacy@fabbri1905.com.

Fabbri's Data Protection Officer can be contacted at the Data Controller's offices at the above address and/or by e-mail at: dpo@fabbri1905.com.

2. CATEGORIES AND TYPES OF PERSONAL DATA PROCESSED

We inform you that, by using the Website, Fabbri may collect and process information and personal data concerning you, which may consist of an identifier such as your name, an identification number, location data, an online identifier or one or more features of your physical, physiological, psychological, economic, cultural or social identity that can identify you or make you identifiable, depending on the type of services you have requested (hereinafter only "Personal Data").

The personal data processed through the Website are as follows:

  • Navigation Data
    The operation of the Website involves the use of computer systems and software procedures that collect information about users of the Website as part of their normal operation. Although Fabbri does not collect such information in order to link it to specific users, it is still possible to identify such users either directly through such information or by using other information collected - as such, this information is also considered Personal Data. This information includes various parameters relating to the user's operating system and computer environment, including the IP address, location (country), computer domain names, the URI (Uniform Resource Identifier) addresses of the resources requested on the Website, the time of requests, the method used to send requests to the server, the size of the file obtained in response to a request, the numerical code indicating the status of the response given by the server (successful, error, etc.), and so on. This data is used for the sole purpose of obtaining anonymous statistical information on the use of the Website, as well as to check its correct operation and to identify any malfunctions and/or abuses of the Website - the data is deleted immediately after processing, unless we need to identify those responsible in the event of hypothetical computer crimes to the detriment of the Website or third parties.

  • Data voluntarily provided by the user
    Subject to the reference to any specific information contained in specific sections of the Website, this Privacy Policy shall also apply to the processing of data that you voluntarily enter in the various forms that may be contained in the Website, such as, for example, the registration and personal account creation form.

  • Data acquired from third parties
    In some cases, Fabbri may also collect your data from sources other than the data subject. This refers, for example, to personal contact data and profiling data regarding your purchase choices and behavioural preferences (such as, for example, data relating to Fabbri products in which you have expressed an interest), which may be communicated to Fabbri by third parties who are independent data controllers (including, for example, MyBaloon S.r.l.s.), provided that you have given your consent for this purpose. Reference is also made to the data that Fabbri collects from third parties, independent data controllers, to verify your status as a Fabbri customer for the provision of particular services, such as the MyBaloon portal managed by MyBaloon S.r.l.s.

  • Cookies
    Click here for the cookie policy.

3. PURPOSE OF THE PROCESSING

Your personal data and information provided by you will be processed, with your consent where necessary, for the following purposes, where applicable:

  • to enable navigation of the Website and the provision of the services made available therein by the Controller, including the management of the Website's security, as well as the registration and creation and management of your personal account;
  • to respond to specific requests addressed to the Data Controller, submitted through the appropriate forms available on the Website;
  • to send you promotional and marketing communications, including the sending of newsletters, information material and commercial communications on the services offered by Fabbri 1905 S.p.A., market research and invitations to events organized by Fabbri 1905 S.p.A, by business partners or third parties, through automated means (SMS, MMS, email, push notifications, fax) and non-automated means (paper mail, telephone with operator); In addition, pursuant to the provisions of Article 130, paragraphs 1 and 2 of the Privacy Code, the sending of direct marketing communications to legal persons through "automated" means is allowed only with the consent of the legal persons themselves. Therefore, Fabbri 1905 S.p.A., with the consent of the legal persons customers in the cases referred to in paragraphs 1 and 2 of Article 130 of the Privacy Code, may send promotional and marketing communications, including the sending of newsletters, information material and commercial communications about the services offered by Fabbri 1905 S.p.A., market research and invitations to events organized by Fabbri 1905 S.p.A, by business partners or third parties, using their contact details, meaning by this the addresses and contact details referring to the entity as a whole, through automated tools (SMS, MMS, e-mail, push notifications, fax, automated call systems without operator, use of social networks, Whatsapp). Communications will be based on the consistency of what is promoted with the profile of the customer company, with its needs and/or consistency with the services/products that characterise the profile of the customer legal entity. In any case, Fabbri guarantees that it will carry out such marketing activities in a sustainable manner, aiming to inform, not to cause annoyance, and to provide proposals tailored to the customer's profile as much as possible. Withdrawal of the consent given by the legal entity customer is possible at any time, without prejudice to the lawfulness of promotional communications made prior to withdrawal.
  • to analyse your purchasing choices and behavioural preferences, in order to better structure customised communications and commercial proposals, to carry out general analyses for strategic orientation and commercial intelligence purposes and, in general, for profiling activities;
  • to fulfil any obligations under applicable laws, regulations or EU legislation, or to comply with requests from the authorities;
  • in the event that it is necessary to ascertain, exercise or defend a right in court;
  • for statistical evaluation and monitoring purposes; this purpose implies an analysis of aggregated information that does not relate to identified or identifiable natural persons and which, therefore, does not constitute personal data and does not in any way enable the Controller to trace your identity.

4. LEGAL BASIS AND MANDATORY OR OPTIONAL NATURE OF PROCESSING

The legal basis for the processing of personal data for the purposes referred to in section a) and b) is Article 6(1)(b) of the Regulation ([...]processing is necessary for the performance of a contract to which the data subject is party or for the performance of pre-contractual measures taken at the data subject's request), as processing is necessary for the provision of services. Providing personal data for these purposes is optional, but failure to do so would make it impossible to access the services requested.

The processing operations carried out for the marketing and profiling purposes described in sections c) and d) are based on the granting of your consent pursuant to Art. 6, par. 1, (a) ([...] the data subject has given consent to the processing of his/her personal data for one or more specific purposes) of the Regulation. Please note that, if you have given your consent to other independent data controllers (including, for example, MyBaloon S.r.l.) to transfer your data to Fabbri for direct marketing purposes, the processing for the purpose referred to in point c) will be based on said consent, in accordance with the provisions of the Guidelines on promotional activities and the fight against spam published by the Italian Data Protection Authority on 4 July 2013. This consent may be revoked at any time without prejudice to the lawfulness of the processing carried out prior to the withdrawal in accordance with the provisions of Article 7 of the Regulation. The provision of your personal data for these purposes is therefore entirely optional and does not affect the use of the services. Should you wish to object to the processing of your data for marketing or profiling purposes, you may do so at any time by contacting the Data Controller at the addresses indicated in the "Contacts" section of this information notice.

The purpose referred to in Section (e) represents legitimate processing of personal data within the meaning of Article 6(1)(c) of the Regulation ([...]processing is necessary for compliance with a legal obligation to which the data controller is subject). Once personal data have been provided, in fact, the processing is indeed necessary to comply with legal obligations to which the Data Controller is subject.

Processing for the purposes set out in section f) is based on the legitimate interest of the Data Controller within the meaning of Article 6(1)(f) of the Regulation.

Finally, it should be noted that the processing referred to in section g), since it does not concern personal data, does not fall within the scope of the legislation on the protection of personal data and can therefore be freely carried out by the Data Controller.

5. RECIPIENTS OF PERSONAL DATA

Your personal data may be shared, for the purposes set out in section 3 of this Policy, with:

  • Subjects typically acting as Data Processors pursuant to Article 28 of the Regulation on behalf of Fabbri, in particular:
    - Subjects in charge of providing the Services (e.g., hosting providers or suppliers of electronic mail platforms);
    - Subjects authorised to perform technical maintenance (including maintenance of network equipment and electronic communication networks).
  • Persons authorised by the Controller, pursuant to Article 29 of the Regulation, to process personal data necessary to carry out activities strictly related to the provision of services, who have committed themselves to confidentiality or have an appropriate legal obligation of confidentiality.
  • Persons, bodies or authorities to whom it is mandatory to communicate your personal data by virtue of legal provisions or orders of the authorities.
  • Your data may be accessible to other companies in the Fabbri Group for the same purposes as above and/or for administrative and accounting purposes pursuant to Art. 6(1)(f) and Recitals 47 and 48 of the Regulation.

These subjects are hereinafter collectively referred to as “Recipients”. The full list of Data Processors is available by sending a written request to the Data Controller at the addresses indicated in the “Contact Us” section of this policy.

6. TRANSFERS OF PERSONAL DATA

Some of your personal data is shared with Recipients who may be located outside the European Economic Area. The Controller ensures that your personal data is processed by these recipients in accordance with Articles 44 - 49 of the Regulation. Indeed, transfers may be based on an adequacy decision or on Standard Contractual Clauses approved by the European Commission or on another appropriate legal basis. More information is available by sending a written request to the Controller at the addresses indicated in the "Contact" section of this policy.

7. STORAGE OF PERSONAL DATA

Personal data processed for the purposes set out in sections a) and b) will be kept for the time strictly necessary to achieve those purposes. In any case, since the processing is carried out for the provision of services, the Data Controller will keep your personal data for the period of time envisaged and permitted by Italian law to protect its interests (Art. 2946 of the Italian Civil Code et seq.). For the purposes set out in sections c) and d), your personal data will instead be processed for the period of time strictly necessary to achieve the purposes for which they were collected, in compliance with the principle of minimisation set out in Article 5(1)(c) of the GDPR and, in any case, until your consent is withdrawn. Upon withdrawal of consent, the data processed for the purposes in sections c) and d) above will be permanently deleted or anonymised. Personal data processed for the purposes referred to in section e) above will be retained for as long as required by the specific obligation or rule of law applicable. In general, the Data Controller reserves the right in any case to retain your data for as long as necessary to fulfil any regulatory obligation to which it is subject or to meet any defensive needs. This is without prejudice to the possibility for the Controller to keep your personal data for the period of time provided for and allowed by Italian law to protect his/her interests (Art. 2947 of the Italian Civil Code). Further information on the data retention period and the criteria used to determine this period may be requested by sending a written request to the Data Controller at the addresses indicated in the "Contacts" section of this notice.

8. RIGHTS OF THE DATA SUBJECT

You have the right to access your Personal Data at any time, pursuant to Articles 15-22 of the Regulation. In particular, you may request rectification (pursuant to Art. 16), deletion (pursuant to Art. 17), limitation (pursuant to Art. 18) and portability of data (pursuant to Art. 20), not to be subjected to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or significantly affects you in a similar way (pursuant to Art. 22), as well as withdrawal of any consent you may have given (pursuant to Art. 7(3)).

You may also submit a request to object to the processing of your Personal Data in accordance with Article 21 of the Regulation, in which you must give evidence of the reasons justifying your objection: the data controller reserves the right to assess your request, which would not be accepted if there were compelling legitimate grounds for processing that override your interests, rights and freedoms. We also inform you that you have the right to object to profiling at any time and without justification. You also have the right to object at any time and without justification to the sending of direct marketing by automated means (e.g., SMS, MMS, email, push notifications, fax, automated call systems without operator) and non-automated means (paper mail, telephone with operator). Furthermore, with regard to direct marketing, this is without prejudice to the possibility of exercising this right also in part, i.e., in this case, objecting, for example, only to the sending of promotional communications by automated means.

Requests should be addressed in writing to the Controller at the addresses indicated in the "Contact" section of this policy. In any event, you always have the right to lodge a complaint with the competent supervisory authority (Personal Data Protection Authority), pursuant to Article 77 of the Regulation, if you believe that the processing of your data is contrary to the legislation in force, or to bring an action before the competent courts pursuant to Article 79 of the Regulation.

9. AMENDMENTS

The Data Controller reserves the right to modify or simply update the content, in part or in full, also due to changes in applicable legislation. The Data Controller therefore invites you to visit this section regularly to acquaint yourself with the most recent and updated version of the Privacy Policy so that you are always up to date on the data collected and the use made of it by Fabbri 1905 S.p.A.

10. CONTACTS

To exercise the above rights or for any other request, you may write to the Data Controller at Via Emilia Ponente, 276 40132 – Bologna, Italy or by e-mail to privacy@fabbri1905.com. You may also contact Fabbri's Data Protection Officer at the Data Controller's registered office at the above address and/or by e-mail at dpo@fabbri1905.com.