INFORMATION ON THE PROCESSING OF PERSONAL DATA PURSUANT TO ART. 13 OF REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL OF 27 APRIL 2016 ("GENERAL REGULATIONS ON DATA PROTECTION")

  1. PREMISE: THE ROLE OF ITECH SRL RESPECT TO THE PROCESSING OF PERSONAL DATA
  2. IDENTITY AND CONTACT DETAILS OF ITECH SRL
  3. CONTACT DATA OF THE PERSON RESPONSIBLE FOR THE PROTECTION OF PERSONAL DATA OF ITECH SRL
  4. DATA PROCESSING BY ITECH SRL FOR ACCESS PURPOSES AND REGISTRATION TO THE SITE, COMPLETION OF THE PURCHASE AGREEMENT AND / OR EXECUTION OF PRE-CONTRACTUAL MEASURES ON REQUEST OF THE INTERESTED PARTY
  5. DATA PROCESSING BY ITECH SRL FOR THE PURPOSE OF GENERIC MARKETING
  6. TREATMENT OF THE E-MAIL ADDRESS BY ITECH SRL FOR THE PURPOSE OF SOFT-SPAM
  7. DATA PROCESSING BY ITECH SRL FOR PROFILING PURPOSES FOR MARKETING PURPOSES
  8. DATA PROCESSING BY ITECH SRL FOR ASSISTANCE / CUSTOMER CARE PURPOSES
  9. DATA PROCESSING BY ITECH SRL FOR PURPOSE PREVENTION PURPOSES IN CASE OF ONLINE PAYMENT BY CREDIT CARD, INCLUDING PROFILING AND MONITORING
  10. TREATMENT OF DATA BY ITECH SRL FOR THE PURPOSE OF PREVENTION OF THE IMPROPER USE OF THE SITE SERVICES, INCLUDING THE MONITORING
  11. DATA PROCESSING BY ITECH SRL FOR ADMINISTRATIVE, ACCOUNTING AND TAX PURPOSES
  12. DATA PROCESSING BY ITECH SRL IN ORDER TO ENABLE USER THE EXERCISE OF RIGHTS
  13. DATA PROCESSING BY ITECH SRL FOR FINALITY OF ASSESSMENT, EXERCISE OR DEFENSE OF A RIGHT
  14. DATA PROCESSING BY ITECH SRL OF DATA RELATING TO HEALTH
  15. CATEGORIES OF PERSONS TO WHICH ITECH SRL COMMUNICATES THE PERSONAL DATA OF THE USER (RECIPIENTS)
  16. OPPOSITION RIGHT
  17. RIGHT OF ACCESS
  18. RECTIFICATION RIGHT
  19. CANCELLATION LAW
  20. TREATMENT RESTRICTION RIGHT
  21. RIGHT TO DATA PORTABILITY
  22. RIGHT TO PROPOSE CLAIM TO A CONTROL AUTHORITY

1. INTRODUCTION: THE ROLE OF ITECH SRL AND THE ROLE RESPECT TO THE PROCESSING OF PERSONAL DATA
The following information is prepared, pursuant to art. 13 of EU Regulation 2016/679 ("Regulation"), by ITECH SRL, in relation to the personal data of users collected during access and / or registration to the sites managed by ITECH SRL www.electronic-bazar.com, www .itech.srl, www.horetech.com, www.egadu.com, www.rider.bike ("Website") and / or the making of a purchase on the Website and / or the request for assistance and customer care services of the Site (cumulatively, the "Site Services").
ITECH SRL operates on the Website, which it owns, as the provider of the registration service and the sales service.
ITECH SRL assumes the role of "data controller" of the user's personal data, pursuant to article 4.7) of the Regulations, for the purposes illustrated in sections 4, 5, 6, 7, 8, 9, 10, 11 , 12, 13 and 14 of this information.

2. IDENTITY AND CONTACT DETAILS OF ITECH SRL
ITECH SRL, with registered office in Via Ugo Foscolo 15, 20013 Magenta (MI), VAT Number / Tax Code 12246900158, operating office in Viale Lombardia 16H, 20081 Cassinetta di Lugagnano (MI), registered in the Milan Register of Companies at 12246900158 , REAN 1542735, fax 0245503301 e-mail info@itech.srl, is the owner of the processing of personal data of users collected during the use of the Site Services and, in particular, access and / or registration to the Website and / or making a purchase on the Website and / or requesting assistance and customer care services on the Website.

3. CONTACT DATA OF THE PERSON RESPONSIBLE FOR THE PROTECTION OF PERSONAL DATA OF ITECH SRL
Users can contact the data protection officer for all matters concerning the processing of their personal data and the exercise of their rights deriving from the Regulation.
The contact details of the ITECH SRL data protection officer are as follows:
- email address: info@itech.srl;
- telephone number: 02 91533804
- mailing address: Viale Lombardia 16H, 20081 Cassinetta di Lugagnano (MI).

4. DATA PROCESSING BY ITECH SRL FOR PURPOSE OF ACCESS AND REGISTRATION TO THE SITE, COMPLETION OF THE PURCHASE AGREEMENT AND / OR EXECUTION OF PRE-CONTRACTUAL MEASURES ON REQUEST OF THE INTERESTED PARTY
ITECH SRL will process your personal data for:
- allow registration to the Site and use of the services reserved for registered users, including the possibility to purchase online through the Website;
- allow the conclusion of the purchase contract through the Website and the correct execution of the obligations arising from this contract, such as, by way of example, the delivery and payment, even online, of the products and / or services purchased;
- execute the requests sent by the user himself.

The legal basis for this treatment is the fulfillment of the contract or, as the case may be, the execution of pre-contractual measures taken at the request of the party concerned (Article 6.1.b) of the Regulation).
For this purpose, ITECH SRL will process the user's data for the time strictly necessary for the performance of the individual processing activities (for example: the registration data will be processed until the account is closed, taking into account the necessary technical times; data necessary for the execution of the purchase contract, will be processed until the delivery of the product or, in case of non-delivery, until the termination of the contract), provided that, after expiry of this term, ITECH SRL may store data for the purposes and for the maximum retention periods referred to in the following sections of this statement and / or, in any case, in the cases established by the Regulations and / or by law.
In particular, within this scope, ITECH SRL will process personal data of users, inter alia, for:
- allow the user to access the Site, even as an unregistered user, and to browse the Site;
- allow the user to register with the Site, creating an account, and to use the services reserved for registered users, including, in particular, the possibility to purchase through the Website, and / or to exercise the right of withdrawal online;
- allow the user to access the Site and browse the Site as a logged in user;
- maintain and manage the user's account;
- storing in the user's account data and information, such as, by way of example, the user's personal data, the history of his orders and any returns, his preferred delivery and / or billing addresses, the preferences expressed in relation to the processing of personal data for general marketing purposes and / or for profiling purposes for marketing purposes;
- allow the user to put the products in the cart and to conclude the purchase contract through the Site;
- allow the user to make online payments for purchases made on the Website;
- execute the purchase contract concluded by the user with ITECH SRL through the Website, by delivering the purchased products or by allowing the provision of the services purchased;
- respond to requests for notification of availability of a product made by the user through the Website.

The provision of data for the purpose in question is optional: there is no legal or contractual obligation to communicate data; however, since their processing is necessary to allow access to the Site and / or navigation on the Site and / or registration to the Site and / or the provision of management and maintenance services of the account as well as the conclusion and execution of the purchase contract through the Site or to respond to pre-contractual requests made by the user, the failure to communicate data will make it impossible for the user to access and / or browse the Site and / or register with the Site and take advantage of services reserved for registered users and / or to conclude a purchase contract through the Website and / or to receive a response to requests made.

5. DATA PROCESSING BY ITECH SRL FOR THE PURPOSE OF GENERIC MARKETING
With the express consent of the user, ITECH SRL will process the user's personal data to send information and promotional communications, including the newsletter, discount coupons and special offers, referring to products and / or services of their own and / or third parties as well as for direct sales and for market research, by e-mail and by postal service.
The legal basis of this processing is the user's express consent (Article 6.1.a) of the Rules).
The user may at any time revoke the consent given and / or oppose, at any time, to the processing of his data for marketing purposes:
- contacting ITECH SRL at the following addresses: info@itech.srl
- through the appropriate link present in every promotional communication sent by ITECH SRL;
- through the account section called "Privacy Policy".

The provision of data for the purpose of generic marketing is optional: there is no legal or contractual obligation on the user to provide such data for this purpose and / or to give consent to the processing of his personal data for this purpose.
For the purpose of generic marketing, ITECH SRL will process the user's data until the revocation of the consent and / or the exercise of the right of opposition and, in any case, no more than four years from the data collection, reserving the right, before the expiry of this deadline, to ask the user to renew consent and / or update the data.
The user is informed of the following:
- for the purpose of generic marketing ITECH SRL uses personal data collected initially for other purposes and, in particular, for purposes of registration to the Site and / or conclusion and / or execution of the purchase contract through the Site; this further processing is allowed, as it is based on the consent of the interested party;
- the withdrawal of consent does not affect the lawfulness of the treatment based on the consent given before the revocation;
- in the event that the user opposes the processing of his data for general marketing purposes and / or withdraws consent to the processing for general marketing purposes, his data will no longer be processed by ITECH SRL for this purpose and will be stored from ITECH SRL only if there is another legal basis (such as, for example, the assessment, exercise or defense of a legal or administrative right);
- failure to provide data for the purpose of generic marketing and / or failure to provide consent to such processing and / or revocation of such consent and / or the exercise of the right to object does not have any consequences on the user's ability to register with the Site and / or make purchases on the same.

6. TREATMENT OF THE E-MAIL ADDRESS BY ITECH SRL FOR THE PURPOSE OF SOFT-SPAM
ITECH SRL will handle the e-mail coordinates (ie the e-mail address) provided by the user in the context of the purchase of a product and / or service offered and sold on the Website directly by ITECH SRL, to allow ITECH SRL the direct sale of similar products or services (and therefore the sending by e-mail to the user of promotional communications concerning such products and / or services) without the express and prior consent of the interested party, as foreseen by the art . 130, fourth paragraph, of the Privacy Code, and on condition that the user does not exercise the right of opposition with the methods indicated below (so-called soft-spam).
The legal basis for this treatment is art. 130, fourth paragraph, of the Privacy Code that expressly allows the processing in question.
The user can object to receiving soft-spam communications:
- contacting ITECH SRL at the following addresses: info@itech.srl;
- through the appropriate link in every promotional communication sent by ITECH SRL.

For the purpose of soft-spam, ITECH SRL will process the user's data up to the exercise of the right of opposition and, in any case, no later than 4 years from the collection.
The provision of data for the purpose in question is optional: there is no legal or contractual obligation on the user to provide such data for this purpose. Failure to provide data for the purpose of soft-spam or the opposition to such treatment will not have any consequence on the possibility of the user to register on the Site and / or make purchases on it.
The user is informed of the following:
- for the purpose of soft-spam ITECH SRL uses personal data collected initially for other purposes and, in particular, for purposes of registration to the Site and / or conclusion and / or execution of the purchase contract through the Site; this further treatment is allowed, as based on art. 130, IV, paragraph, of the Privacy Code;
- in the event that the user objects to the processing of his data for the purposes of soft-spam, his data will no longer be processed by ITECH SRL for this purpose and will be retained by ITECH SRL only in the event that there is another legal basis (such as, for example, the establishment, exercise or defense of legal or administrative rights).

7. DATA PROCESSING BY ITECH SRL FOR PROFILING PURPOSES FOR MARKETING PURPOSES
With the explicit consent of the user, ITECH SRL will process the personal data of the users, in an automated way, for:
- monitor and track user behavior on the Site, collecting and recording data related to navigation (eg: pages visited, categories of products seen, if the user has purchased or has not purchased, abandoned carts, access device) and data of purchase (eg: type of product purchased, frequency of purchases, amounts spent, payment methods);
- analyze and process such data, together with other information relating to users (such as, by way of example, gender, order status, postal code, date of birth, IP address), in order to identify correlations between user behavior and insert the same in various "clusters" or groups of types of customers that may have common characteristics;
- send, by e-mail or by post, and / or display on the Website to users personalized offers, that is combined with the cluster in which the user has been entered and, therefore, of his presumed specific interest.

All the processing steps, including the final decision about the promotional communication to be sent or displayed to the user on the basis of the cluster (s) they belong to, take place completely automatically, without any human intervention, on the basis of an algorithm whose parameters they have been previously set by ITECH SRL.
The decision based solely on automated processing, including profiling, produces legal effects that affect the data subject (ie the limitation of his freedom of choice) and is allowed by the exemption reason pursuant to art. 22.2.a) of the GDPR, as it is necessary for the execution of the contract between the data controller and the data subject and / or in any case connected to this contract and its validity and effectiveness.
The user therefore has the right, at any time, to:
- obtain human intervention by ITECH SRL;
- express your opinion;
- challenge the decision taken by ITECH SRL (eg: inclusion in a given cluster).

To exercise this right, the user can contact ITECH SRL at the following addresses: info@itech.srl
The legal basis of this processing is the explicit consent of the interested party (Article 21.1.c) of the Rules).
The user can revoke at any time the consent given and / or oppose, at any time, to the processing of his data for marketing purposes for profiling purposes:
- contacting ITECH SRL at the following addresses: info@itech.srl;
- through the appropriate link present in every promotional communication sent by ITECH SRL;
- through the account section called "Privacy Policy".

For the purpose of profiling for marketing purposes, ITECH SRL will process the user's data until the revocation of consent and / or the exercise of the right of opposition.
The provision of data for the purpose of profiling for marketing purposes is optional: there is no responsibility for the user a legal or contractual obligation to provide such data for this purpose and / or to give consent to the processing of his data for that purpose. purposes.

The user is informed of the following:
- users, upon their consent, are grouped on the basis of characteristics identified by ITECH SRL and for these reasons included in specific clusters. The clusters are created on the basis of both individual characteristics related to the service of the site that users have used (ie: pages visited, products viewed, frequency and type of purchases) and other information relating to users (eg: gender, band age, order status, used device, postal code, profession, interests). ITECH SRL then sends users or displays "targeted" promotional communications to users, as they correspond to the user profile that has been created and automatically matched to the cluster in which the user has been entered. Each user can be placed in more than one cluster. Clusters can be crossed. As a result of this processing activity, therefore, the user receives promotional communications with a content other than that of the communications received by another user, or the user displays recommended or suggested products on the Site other than those displaying another user or in an order different from that of another user;
- for the purpose of profiling for marketing purposes, ITECH SRL also uses personal data collected initially for other purposes and, in particular, for purposes of registration to the Site and / or conclusion and / or execution of the online purchase contract and / / or browsing the site; this further processing is allowed, as it is based on the consent of the interested party;
- the withdrawal of consent does not affect the lawfulness of the treatment based on the consent given before the revocation;
- in the event that the user objects to the processing of his data for the purpose of profiling for marketing purposes and / or withdraws consent to the processing for purposes of profiling for marketing purposes, his data will no longer be processed by ITECH SRL for this purpose and will be retained by ITECH SRL only if there is another legal basis (such as, for example, the assessment, exercise or defense of a right in court or administrative or the fulfillment of obligations of law);
- failure to provide data for the purpose of profiling for marketing purposes and / or failure to provide consent to such processing and / or revocation of such consent and / or the exercise of the right of opposition will not have any consequence on the possibility user to register with the Site and / or to make purchases on the same.

8. DATA PROCESSING BY ITECH SRL FOR ASSISTANCE PURPOSES / CUSTOMER CARE
ITECH SRL will process user data for general assistance and customer care activities and then to respond to requests for information from users or to respond to complaints, reports, disputes and in order to allow the user, if desired, to release a review.
The legal basis of this treatment is the execution of pre-contractual measures taken at the request of the interested party (Article 6.1.b, last sentence of the Regulation) or, as the case may be, the legitimate interest of ITECH SRL (Article 6.1. f) of the Regulations).
ITECH SRL has a legitimate interest in responding to requests for information and / or reviews and / or complaints and / or complaints and / or complaints from users of the Site (to which, moreover, ITECH SRL is required to respond, even in based on the legislation referred to in the Consumer Code). This legitimate interest of ITECH SRL also coincides with the legitimate interest of the users of the Website who make the requests and / or reports and / or disputes and / or complaints in question and, therefore, in the context of the relationship with ITECH SRL , it can be reasonably expected to expect their personal data to be used by ITECH SRL to provide feedback.
The legitimate interest of ITECH SRL thus identified can therefore be considered prevalent on the fundamental rights and freedoms of the interested party, also on the basis of such reasonable expectations and the relationship between the interested party and ITECH SRL and in consideration of the nature of the data processed and coincident interest of the same interested parties.
In any case, the user has the right to oppose, at any time, for reasons related to his personal situation, to the processing of personal data concerning him for the purpose in question (ie assistance and customer care).
To exercise this right, the user can contact ITECH SRL at the following addresses: info@itech.srl.

In the exercise of the right to oppose the processing of data for purposes of assistance / customer care, ITECH SRL refrains from further processing the personal data of users for this purpose, unless it demonstrates the existence of legitimate reasons binding to proceed with the processing which override the interests and rights and freedoms of the data subject or for the establishment, exercise or defense of a right in court.
The provision of personal data for the purpose in question is optional: there is no legal and / or contractual obligation to communicate data; however, given the purpose of the processing, the failure to communicate data and / or the exercise of the right of opposition may make it impossible to respond to requests and / or complaints and / or complaints and / or complaints of users, if the response to these requests implies the processing of personal data of the user.
For this purpose, ITECH SRL will process the user's data for the time necessary to perform the requested activities and, therefore, in particular, for the time necessary to provide the information requested by the user or to respond to complaints and / or reports and / or to the complaints presented by the user or to publish the review issued by the user.

9. TREATMENT OF DATA BY ITECH SRL FOR PURPOSE PREVENTION PAYMENTS IN CASE OF ONLINE PAYMENT BY CREDIT CARD, INCLUDING PROFILING AND MONITORING
ITECH SRL will process the personal data of users for the purpose of, in the case of payment of purchases made on the Site by credit card, to manage and possibly block payment transactions relating to fraudulent orders, including through monitoring of user behavior and creating their profiles. This treatment will take place through an anti-fraud computer system and therefore completely automated.
The legal basis of this processing is the legitimate interest of ITECH SRL (Article 6.1.f) of the Regulations).
In any case, the user has the right to object, at any time, for reasons connected with his personal situation, to the processing of personal data concerning him / her for the purpose in question (ie fraud prevention).
To exercise this right, the user can contact ITECH SRL at the following addresses: info@itech.srl

All the processing steps, including the analysis of the system to decide whether or not a transaction should be authorized and the decision about the resolution of the purchase contact, in the event of an unauthorized transaction, can be made using the information received from the gateway managers of payment with credit cards (as an example but not exhaustive: PayPal).
The decisions, based on information received from credit card payment managers and any control bodies, produce legal effects affecting the data subject (ie the termination of the purchase contract, in the case of an unauthorized transaction) and is legitimized by the cause of exemption pursuant to art. 22.2.a) of the GDPR, as it is necessary for the execution of the contract between the data controller and the data subject and / or in any case connected to this contract and its validity and effectiveness.

The user therefore has the right, at any time, to:
- obtain human intervention by ITECH SRL;
- express your opinion;
- challenge the decision taken by ITECH SRL.

To exercise these rights, the user can contact ITECH SRL at the following addresses: info@itech.srl
For the purpose of anti-fraud prevention ITECH SRL will process the personal data of users, including those of unsuccessful and / or unauthorized transactions, included in the black list, for 24 months from collection.
As for the legitimate interest of ITECH SRL, the anti-fraud system and the logic used to reach the decision about the termination of the purchase contract, the user is informed of the following:
- ITECH SRL is a legitimate interest in carrying out an activity, including monitoring and profiling, for fraud prevention purposes, in the case of online payment by credit card, to protect its business interests, including the purpose of respecting the parameters defined by international circuits relating to the number of fraudulent payment attempts detected on e-commerce sites. This legitimate interest of ITECH SRL coincides, moreover, with the legitimate interest of the users of the Site, as potential victims of frauds, which, like the whole community, have, in their turn, a legitimate interest in ensuring that fraudulent activities are discouraged and identified when they occur; we can therefore assume that, as part of the relationship with ITECH SRL, they reasonably expect their data to be processed also for fraud prevention purposes, for their own protection and guarantee.
- the Site, at the moment of pressing the "Buy" button, at the end of the check-out and after entering the data relating to the credit card with which the user intends to pay for the purchase, sends the data to the anti-fraud system of the transaction (amount of the authorized sum, BIN of the credit card used and its last 4 digits, identification of the transaction), the data of the customer host (name, surname, e-mail address, street address, telephone number, IP address) , shipping and billing data and purchase information (category, title and price);
- these data are then verified by the anti-fraud systems applied by gateways managing credit card payments (as an example but not exhaustive: PayPal), based on certain parameters, such as: congruity between the place of issuance of the card and IP address from where the transaction request arrives, number of purchases made in the day by the same card, total value of purchases, name of the buyer without vowels, originated from domains historically labeled as unsafe, checks on different addresses used for payments with the same card , consistency between the card data and those relating to previous transactions, number of payments in a predetermined period of time, checks on any attempts to purchase with sequential card numbers;
- the overall result of this control operation is then communicated to ITECH SRL with the indication that the transaction has been authorized or not authorized. In the event that the transaction is not authorized, a Customer Care representative of ITECH SRL proceeds, without further evaluation and without contacting the user, to the termination of the purchase contract;
- once the verification by the anti-fraud system has been completed, the data of the failed transactions are entered in a special blacklist, in which not all the identification data of the previously indicated buyers converge, but only some data of the rejected transactions and, in particular , credit card number, email address and device id.

Furthermore, the user is advised that:
- the provision of data for the purpose in question (ie fraud prevention purposes) is optional: there is no legal or contractual obligation to provide such data for this purpose;
- for the purpose in question, ITECH SRL uses personal data collected initially for different purposes (and, in particular, to allow access and navigation on the Site or the conclusion of the purchase contract and its execution) whose further processing for the fraud prevention purposes are allowed, as it is based on the legitimate interest of ITECH SRL, waiting for the compatibility of the fraud prevention purpose with the purpose for which the data are initially collected;
- failure to provide personal data for the purpose in question and / or opposition to the use of such data for this purpose will not result in any consequence on the user's ability to register on the Site and / or make purchases on it;
- in the exercise of the right to object, ITECH SRL refrains from further processing the personal data of the users for the purpose in question, unless it proves the existence of binding legitimate reasons to proceed with the processing that prevail over the interests and rights and freedom of the interested party or for the establishment, exercise or defense of a right in court.

10. DATA PROCESSING BY ITECH SRL FOR THE PURPOSE OF PREVENTING THE IMPROPER USE OF THE SITE SERVICES, INCLUDING THE MONITORING
ITECH SRL will process the personal data of users in order to prevent the misuse of its services and, in particular, the non-payment of purchases made on the Site, including through monitoring of user behavior. This treatment will take place through an automated system that operates on the basis of the rules set by ITECH SRL and that takes into account the user's history regarding the payments made on the site.
The legal basis of this processing is the legitimate interest of ITECH SRL (Article 6.1.f) of the Regulations).

In any case, the user has the right to object, at any time, for reasons connected with his personal situation, to the processing of personal data concerning him / her for the purpose in question (ie fraud prevention).
To exercise this right, the user can contact ITECH SRL at the following addresses: info@itech.srl

All the stages of the treatment, including the analysis of the system to decide whether a user is a good or a bad payer and the decision about the resolution of the purchase contact, in the latter case, take place in a completely automated way, without any intervention human, based on an algorithm whose parameters were previously set by ITECH SRL and which provides for the termination of all contracts related to subjects identified by the system as "bad payers".
The decision based solely on automated processing, including profiling, produces legal effects affecting the data subject (ie the termination of the purchase contract) and is permitted by the exemption reason pursuant to art. 22.2.a) of the GDPR, as it is necessary for the execution of the contract between the data controller and the data subject and / or in any case connected to this contract and its validity and effectiveness.

The user therefore has the right, at any time, to:
- obtain human intervention by ITECH SRL;
- express your opinion;
- challenge the decision taken by ITECH SRL.

To exercise these rights, the user can contact ITECH SRL at the following addresses: info@itech.srl
For the purpose of preventing the misuse of the Website Services, ITECH SRL will process the personal data of users for 24 months from collection.
As for the legitimate interest of ITECH SRL, the system and the logic used to reach the decision about the termination of the purchase contract, the user is informed of the following:
- ITECH SRL is a legitimate interest in carrying out an activity, including monitoring, for the purpose of preventing the improper use of its services, aimed in particular at preventing non-payment of products purchased through the Site. ITECH's legitimate interest SRL also coincides with the legitimate interest of users of the Site and, in general, of the community, which in turn have a legitimate interest in ensuring that fraudulent activities are discouraged and identified when they occur; it can therefore be assumed that users, in the context of the relationship with ITECH SRL, reasonably expect their data to be processed also for purposes of preventing the misuse of the Website Services,to their own protection and guarantee and that consequently the legitimate interest of ITECH SRL can be considered prevalent on the interests, rights and freedoms of the interested party;
- the provision of data for the purpose in question (ie the purpose of preventing the improper use of Site Services) is optional: there is no legal or contractual obligation to provide such data for this purpose;
- for this purpose, ITECH SRL uses data collected initially for different purposes (and, in particular, to allow access and navigation on the Site or the conclusion of the purchase contract and its execution) whose further processing for the purpose of preventing the improper use of the Website Services is allowed, as it is based on the legitimate interest of ITECH SRL, waiting for the compatibility of the purpose of preventing the improper use of the Website Services for the purpose for which the data are initially collected;
- failure to provide personal data for the purpose in question or opposition to the use of such data for this purpose will not have any consequence on the user's ability to register on the Website and / or make purchases on the same.
- in the exercise of the right to object, ITECH SRL refrains from further processing the personal data of users for this purpose, unless it demonstrates the existence of binding legitimate reasons to proceed with the processing that prevail over the interests and rights and freedoms of the concerned or for the establishment, exercise or defense of a right in court.

11. TREATMENT OF DATA BY ITECH SRL FOR ADMINISTRATIVE, ACCOUNTING AND TAX PURPOSES
ITECH SRL will process user data for the execution of administrative and / or accounting and / or tax obligations related to the provision of the Services of the Site and / or the purchase contract concluded through the Site, such as, by way of example, the keeping of the accounting records and the issue of the sales invoice.
The legal basis of this treatment is the fulfillment of legal obligations to which ITECH SRL is subject (Article 6.1.c) of the Regulations).
The provision of data for the purpose in question is mandatory, because their processing is necessary to allow ITECH SRL to fulfill legal obligations on the same. Any refusal to provide data for this purpose will make it impossible for the user to use the Website Services and, in particular, to conclude the purchase contract through the Site.
For this purpose, ITECH SRL will process the data of the the user until the expiry of the terms of the law envisaged for the execution of each administrative-accounting and fiscal fulfillment and / or for the retention times established by law for the conservation of the relative documentation.

12. DATA PROCESSING BY ITECH SRL IN ORDER TO ENABLE THE USER TO EXERCISE ITS RIGHTS
ITECH SRL will process user data in order to:
- give feedback to requests to exercise the right of withdrawal and / or requests for exercise of the legal guarantee of conformity and / or other rights arising from the purchase contract concluded on the Website and / or provided for by law in relation to this contract and / or, as regards ITECH SRL, in relation to the performance of the Site Services;
- carry out the activities that prove necessary as a consequence of the exercise of these rights and to proceed, where appropriate, to the relative reimbursements;
- receive and respond to requests for the exercise of rights in the matter of protection of personal data provided for by the Regulations and carry out all consequent activities.

The legal basis of this treatment is the fulfillment of legal obligations to which ITECH SRL is subject (Article 6.1.c) of the Regulations).
The provision of data for the purpose in question is mandatory, because their processing is necessary to allow ITECH SRL to comply with legal obligations as well as the user to exercise the rights that the law or the contract assign to him. Any refusal to provide data for this purpose will make it impossible for the user to exercise such rights.
For this purpose, ITECH SRL will process the data up to the expiration of the statutory time limits envisaged for the exercise of the right (limitation period and / or forfeiture) or, in the case of exercising these rights, for the time necessary for management and closure of the practice; in the case of exercising the rights envisaged by the Regulations, the data will be processed until the certification, by the data controller, has fulfilled the request or until the fulfillment itself, depending on which of the two events occurs last.

the extent that processing is necessary for the establishment, exercise and defense of a right, the data controller is also exempted from the obligation of cancellation, by express provision of the Regulation;
- in the case of exercising the right of opposition, the data controller refrains from further processing personal data, unless he demonstrates the existence of binding legitimate reasons for proceeding with the processing that prevail over the interests, rights and freedoms of the interested party or for the establishment, exercise or defense of a right in court.

14. DATA PROCESSING BY ITECH SRL OF DATA RELATING TO HEALTH
For the registration to the site it is not required to provide data on health. Also for the purpose of concluding a purchase contract through the Website, the provision of health data is not required.
It may happen, however, that, in case of purchase of specific products (such as, for example, orthopedic mattresses) ("Sensitive Products"), ITECH SRL may process data that, according to art. 4.15) of the Regulations, can be considered as "data relating to health", since they can be inferred, even indirectly, the state of health of a natural person or they can infer information about his state of health.
These data will be processed only for the purpose of executing the purchase contract and only and exclusively with the explicit and specific consent of the interested party, which will be requested by the user before the transmission of the order having as object Sensitive Products.
The legal basis of this processing is the explicit consent of the interested party (Article 9.2.a) of the Rules).

Furthermore, ITECH SRL will process health data, if the user intends to make use of the reduced VAT rate in relation to the purchase of a product that admits the application of this regime, as required by the Law of 28 February 1997, n . 30. In this case, in fact, the user will be asked to provide documentation proving the existence of a disability and, therefore, the provision of data relating to health, according to the definition under Article. 4.15) of the Rules.
These data will be processed only in order to allow ITECH SRL to comply with the provisions of the Law of 28 February 1997, n. 30 relative to the application of the reduced rate of VAT and only and exclusively with the explicit and specific consent of the interested party, which will be requested by the user at the same time as sending the documentation concerning the existence of the disability.
The legal basis of this processing is the explicit consent of the interested party (Article 9.2.a) of the Rules).
The provision of data relating to health is optional: there is no legal or contractual obligation that provides for the user's obligation to provide such data. Also the conferment of consent to the processing of such data is optional. However, waiting for the purpose of the processing (ie allowing the conclusion and execution of the purchase contract or the fulfillment of the provisions of the Law of 28 February 1997, No. 30 on the subject of reduced rate of VAT), in the event of failure to provide such data and / or failure to consent to the processing of data relating to health, the user can not conclude the purchase contract of the Sensitive Product nor can request the application of the reduced VAT rate.

It should be noted that:
- the consent given will be effective only in relation to the specific order or, respectively, to the specific request for facilitated VAT and, therefore, in relation to the personal data relating to health related to that order or to such request;
- in the event that the user wishes to purchase another Sensitive Product or make another purchase of the same Sensitive Product or in the event that he / she proceeds in relation to another order to a new request for facilitated VAT, the consent to the processing of the relative data he will be asked to apply again to the health, provided that the consent expressed in relation to an order can be revoked at any time without prejudice to the lawfulness of the treatment based on the consent given before the revocation.
The user can revoke the consent by contacting ITECH SRL at the following addresses info@itech.srl ;;
For this purpose, ITECH SRL will process the data for the time necessary to execute the purchase contract or, respectively, for the time strictly necessary for the requirements related to the request for a reduced VAT rate, stop the further retention periods permitted by law or from the Regulations.

15. CATEGORIES OF PERSONS TO WHICH ITECH SRL COMMUNICATES THE PERSONAL DATA OF THE USER (RECIPIENTS)
The personal data provided by the user can be communicated by ITECH SRL to the categories of recipients indicated below.
The parties to whom ITECH SRL communicates the data, act as external managers of the treatment designated by ITECH SRL through a specific contract ("Data Processors") or persons authorized to process personal data under the direct authority of ITECH SRL ( "Invoices") or, in the case of third parties for which the Data Processor uses, as "Sub-Responsible", pursuant to art. 28.4 of the Regulations, except in cases where the addressees act as independent data controllers, such as, for example, in the case of the Payment Service Provider, or even autonomous data controllers, as in the case of the couriers.

Users' personal data may be communicated by ITECH SRL to the following categories of recipients:
- to employees and / or collaborators of ITECH SRL, for the performance of administration, accounting and IT and logistics support;
- to companies, consultants or professionals who may be in charge of installation, maintenance, updating and, in general, the management of ITECH SRL hardware and software (including the platform), including the providers of cloud computing services, and to third parties of which they avail themselves;
- to companies appointed by ITECH SRL to send commercial communications both by e-mail and by post;
- to companies that provide logistical support and / or warehouse and / or packaging and / or dispatch and delivery or collection of the Products purchased on the Site and to third parties of which they avail themselves;
- to Payment Server Providers and / or to the acquirer and / or to banks in order to allow payment of purchases made on the Site or their reimbursement, where appropriate and to third parties of which they avail themselves;
- companies that provide software for tracking, monitoring and profiling activities both for marketing purposes and for purposes of preventing fraud and improper use of services and the third parties they use;
- to companies and / or natural persons who carry out the service of installation of the products purchased on the Site and to third parties of which they avail themselves;
- to companies and / or natural persons responsible for the repair of products purchased on the Site in execution of the legal guarantee of conformity and to third parties of which they avail themselves;
- to companies that carry out the service of collection of used goods (WEEE) in the case of purchase on the Site of an equivalent product;
- to companies that provide warranty extension services marketed by ITECH SRL through the Website;
- to all those subjects, including public authorities, who have access to data under regulatory or administrative provisions.
- to all those public and / or private entities, natural and / or legal persons (legal, administrative and fiscal consultancy), if the communication proves necessary or functional to the correct fulfillment of the contractual obligations assumed in relation to the Site Services, including the purchase contract, as well as the obligations deriving from the law or in the case of assessment, exercise or defense of a right.
The list of recipients is available at the headquarters of ITECH SRL.

16. RIGHT OF OPPOSITION
The interested party has the right to oppose at any time, for reasons connected with his particular situation, to the processing of personal data concerning him / her for the purposes set out in sections 9, 10, 11, and 14 of this information and having as its legal basis the legitimate interest of the data controller.
In the event that the data are processed for direct marketing purposes (and therefore in the case of processing for the purposes set out in sections 6, 7, and 8 of this statement), the data subject also has the right to object at any time. to the processing of personal data concerning him for these purposes, including profiling in so far as it is connected to such direct marketing.
The interested party may exercise the right to object to the data controller in the following ways:
- by contacting ITECH SRL at the following addresses: info@itech.srl;
The interested party may also object to the further processing of his data for direct marketing purposes (purposes set out in sections 5, 6, and 7 of this statement):
- through the appropriate link in any promotional communication sent by ITECH SRL;
- via the account section called "[Privacy Policy]".

In the exercise of the right of opposition, the data controller refrains from further processing personal data, unless he demonstrates the existence of binding legitimate reasons to proceed with the processing that prevail over the interests, rights and freedoms of the data subject. or for the assessment, exercise or defense of a right in court.
If the data subject objects to processing for direct marketing purposes, personal data are no longer processed for this purpose.

17. RIGHT OF ACCESS
The interested party has the right to obtain from the data controller confirmation that it is or is not undergoing treatment of personal data concerning him and, in this case, to obtain access to personal data and information following indicated.
The interested party can exercise the right of access by contacting ITECH SRL at the following addresses: info@itech.srl;
In the case of exercising the right of access, the user can obtain access to personal data and the following information:
a) the purposes of the processing;
b) the categories of personal data in question;
c) the recipients or categories of recipients to whom the personal data have been or will be communicated, in particular if recipients of third countries or international organizations;
(d) where possible, the retention period of the personal data provided or, if not possible, the criteria used to determine this period;
e) the existence of the right of the data subject to request the data controller to correct or delete personal data or limit the processing of personal data concerning him or to oppose their treatment;
f) the right to lodge a complaint with a supervisory authority;
g) if the data are not collected from the data subject, all information available on their origin;
(h) the existence of an automated decision-making process, including profiling, which produces legal effects affecting the data subject or which significantly affects his person, and at least in such cases, significant information on the logic used, as well as the importance and expected consequences of this treatment for the data subject;

If personal data are transferred to a third country or to an international organization, the data subject has the right to be informed of the existence of adequate guarantees regarding the transfer, pursuant to art. 46 of the Rules.
The data controller provides a copy of the personal data being processed. In case of further copies requested by the interested party, the data controller may charge a reasonable fee contribution based on administrative costs. If the interested party submits the request by electronic means, and unless otherwise indicated by the interested party, the information is provided in a commonly used electronic format.

18. RIGHT OF RECTIFICATION
The interested party has the right to obtain from the data controller the correction of personal data concerning him without unjustified delay. Taking into account the purposes of the processing, the data subject has the right to obtain the integration of incomplete personal data, also by providing an additional declaration.
The interested party can exercise the right of rectification by contacting ITECH SRL at the following addresses: info@itech.srl;

19. RIGHT OF CANCELLATION
The data subject has the right to obtain from the data controller the deletion of personal data concerning him without undue delay and the data controller is obliged to cancel the personal data without undue delay if one of the data following reasons:
a) personal data are no longer necessary with respect to the purposes for which they were collected or otherwise processed;
b) the interested party revokes the consent on which the treatment is based (and, therefore, in the case of revocation of consent to the processing for the purposes set out in sections 6, 8 and 15 of this information), if there is no other legal basis for the treatment;
c) the interested party opposes the treatment based on the legitimate interest of the data controller for reasons related to his particular situation (and, therefore, in cases of opposition to the processing for the purposes set out in sections 9, 10, 11 and 14 of this information) and there is no legitimate overriding reason or opposes the processing of your personal data for direct marketing purposes, including profiling in so far as it is related to such direct marketing (and, therefore, in the case of opposition to treatment for the purposes set out in sections 6, 7, and 8 of this statement);
d) personal data are unlawfully processed;
e) personal data must be deleted to fulfill a legal obligation under Union law or the Member State to which the data controller is subject.
The interested party can exercise the right of cancellation by contacting ITECH SRL at the following addresses: info@itech.srl;

If the data controller discloses the personal data and is obliged to delete them, taking into account the available technology and the costs of implementation, it adopts reasonable measures, including technical ones, to inform the data controllers who are processing the personal data of the request of the data subject to delete any link, copy or reproduction of his personal data.
The right of cancellation does not apply to the extent that the treatment is necessary:
a) for the exercise of the right to freedom of expression and information;
(b) for the fulfillment of a legal obligation under Union or Member State law to which the holder is subject either for the performance of a task carried out in the public interest or in the exercise of official authority;
c) for reasons of public interest in the public health sector;
d) for the purposes of archiving in the public interest, for scientific or historical research or for statistical purposes, insofar as the right of cancellation risks making it impossible or seriously prejudices the achievement of the objectives of such treatment;
e) for the assessment, exercise or defense of a right in court.

20. TREATMENT RESTRICTED RIGHT
The interested party has the right to obtain from the data controller the limitation of treatment when one of the following hypotheses occurs:
a) the interested party disputes the accuracy of personal data for the period of time necessary for the holder of the treatment to verify the accuracy of such personal data;
b) the processing is illegal and the interested party opposes the cancellation of personal data and asks instead that its use is limited;
c) although the data controller no longer needs it for processing purposes, personal data are necessary for the data subject to verify, exercise or defend a right in court;
d) the interested party has opposed the treatment in the hypothesis of treatment based on the legitimate interest of the data controller, for reasons connected to his particular situation, pending verification of the possible prevalence of the legitimate reasons of the data controller with respect to those of the interested party.
The interested party can exercise the right of limitation by contacting ITECH SRL at the following addresses: info@itech.srl;

If the treatment is limited, the personal data object of the limitation are treated, except for the conservation, only with the consent of the interested party or for the verification, the exercise or defense of a right in court or to protect the rights of another natural or legal person or for reasons of a significant public interest of the Union or of a Member State.
The party who has obtained the processing limitation is informed by the data controller before the limitation is revoked.

21. RIGHT TO DATA PORTABILITY
The data subject has the right to receive, in a structured format, commonly used and readable by automatic device, the personal data concerning him / her provided to a data controller and has the right to transmit such data to another data controller without hindrance by the data controller who provided them, if:
a) the processing is based on the consent of the data subject or on a contract;
b) the treatment is carried out by automated means.

The interested party can then exercise the right in object in relation to the purposes referred to in the following sections of this statement: 4, 5, 6, 8, 15.
The interested party can exercise the right to portability by contacting ITECH SRL at the following addresses: info @ itech.srl;
In exercising its right to data portability, the data subject has the right to obtain direct transmission of personal data from one data controller to another, if technically feasible.
The exercise of the right to portability is without prejudice to the right to cancellation. The right to portability must not harm the rights and freedoms of others.

22. RIGHT TO PROPOSE CLAIM TO A CONTROLLING AUTHORITY
Without prejudice to any other administrative or judicial appeal, the interested party who considers that the treatment concerning him / her is in violation of the Regulations has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which he normally resides, works or where the alleged violation has occurred. The supervisory authority to which the complaint has been lodged shall inform the complainant of the status or outcome of the complaint, including the possibility of a judicial remedy.


Categories

PayPal