INFORMATION ON THE PROCESSING OF PERSONAL DATA PURSUANT TO ARTICLE 13 OF REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL OF APRIL 27, 2016 ("GENERAL DATA PROTECTION REGULATION")
1. Background: the role of PELLICONI & C. SPA and CALICANTUS S.R.L. in the processing of personal data collected through the Site.
2. Identity and contact details of CALICANTUS S.R.L. as the autonomous owner
3. Data processing by CALICANTUS S.R.L. for purposes of conclusion and execution of the purchase contract and customer care
4. Data processing by CALICANTUS S.R.L. for administrative, accounting and tax purposes
5. Data processing by CALICANTUS S.R.L. for payment purposes
6. Data processing by CALICANTUS S.R.L. for loyalty purposes.
7. Processing of data by CALICANTUS S.R.L. in order to enable the user to exercise rights
8. Data processing by CALICANTUS S.R.L. for purposes of establishing, exercising or defending a right
9. Categories of subjects to whom CALICANTUS S.R.L. communicates the user's personal data (recipients)
10. Transfers to countries non-EU
11. Rights of the data subject
12. Time and manner of response in case of exercising the rights of the data subject
13. Right to file a complaint with a supervisory authority
1. Background: the role of PELLICONI & C. SPA and CALICANTUS S.R.L. in the processing of personal data collected through the Site.
The following information is intended for all individuals who make purchases on the official e-commerce Website: https://www.p-ink.shop/ (hereinafter "Site").
On the Site you can purchase custom packaging (hereinafter referred to as "Products").
The Site is the property of PELLICONI & C. SPA(hereinafter "PELLICONI"), which is also the domain name owner and holder, among others, of the trademarks P-ink, as well as the provider of the Site registration service.
The offer and sale of the Products on the Site are carried out by CALICANTUS S.R.L., which, upon authorization and assignment of PELLICONI is in charge of the management of sales and transactions performed through the Site (for example: order management, sale and delivery of products).
PELLICONI provides the services that enable access, navigation and registration to the Site, which is necessary to be able to make the purchase of Products, as well as related support services.
PELLICONI and CALICANTUS will process the personal data provided by you for the registration to the Site and respectively, for the conclusion of the purchase contract through the Site as autonomous holders (each, an "Autonomous Holder" and jointly "Autonomous Holders "), in accordance with the provisions of EU Regulation 679/2016 (the "Regulation") and Legislative Decree 30 June 2003, No. 196 (the "Privacy Code") as novated by Legislative Decree 101/2018.
In particular:
● PELLICONI will process the user's personal data, as Autonomous Controller, in order to manage access to the Site and facilitate the purchase of Products as well as to allow registration to the Site and the possible conclusion of the purchase contract through the Site as well as, subject to the consent of the interested party, for general marketing purposes;
● CALICANTUS will process the user's personal data, as Autonomous Holder, to enable the conclusion of the purchase contract, to execute the obligations arising from such contract, to fulfill all legal obligations, including tax and administrative obligations, arising therefrom as well as for other purposes related to such contract and/or the execution of pre-contractual measures, as described in this notice;
The treatments carried out by Pelliconi & C. S.p.A., Ozzano dell'Emilia (Bologna) Italy, via Emilia n. 314 , R.E.A. BO 193288 - COMM. ESTERO M. BO 005562 - REG. IMP. TRIB. BO - P.I.V.A. IT00502181209 - C.F. 00315140376, as Autonomous Owner, are described in the Privacy Policy of Pelliconi, to which reference is made in its entirety, made available in the footer ofThe Site at the link https://p-ink.shop/privacy-policy/
This information is therefore made with reference only to the processing carried out by CALICANTUS as Autonomous Holder.
2. Identity and contact details of CALICANTUS S.R.L. as the autonomous owner
CALICANTUS is the Autonomous Data Controller of the data you provide when concluding a purchase contract through the Site, for the purposes outlined in this policy.
CALICANTUS' identification and contact details are as follows:
CALICANTUS S.R.L
c.a. Customer Service Shop
Via Luigi Mazzon 28-30, 30020 Quarto D'Altino (VE)
C.F. and VAT no: IT037590272
REA VE-335872
Web site: https://calicant.us/
E-mail: privacy@calicant.us
PEC: calicantussrl@dadapec.com
The Data Controller has appointed as:
● D.P.O. (Data Protection Officer) - R.P.D. (Data Protection Officer). You may also contact the Data Protection Officer to obtain information and submit requests about your data or to report inefficiencies or any problems you may encounter. The Data Controller has appointed Mr. Nicola Ghinello as Data Protection Officer, whom you can contact by e-mail: nicola.ghinello@dpo-rpd.com .
● Appointees. The updated list of data processors is kept at the Data Controller's office.
● Data Processors. The updated list of data processors is kept at the Data Controller's office.
3. Data processing by CALICANTUS S.R.L. for purposes of conclusion and execution of the purchase contract and customer care
CALICANTUS, as the Autonomous Holder, will process your personal data:
● to enable the conclusion of the purchase contract through the Site (e.g., loading the Products into the shopping cart and choosing the payment method);
● to perform the obligations incurred by CALICANTUS under such contract, such as, without limitation, delivery of the Products sold;
● to enable you to fulfill your obligations arising from the purchase contract concluded through the Site, such as, but not limited to, online payment for the products purchased;
● for generic assistance and customer care activities and thus to respond to requests for information from users or to respond to complaints, reports and disputes, as far as CALICANTUS is concerned.
The legal basis for this processing is the fulfillment of the contract (Art. 6.1(b) of the Regulations).
For this purpose, CALICANTUS will process your data for the time strictly necessary for the performance of the individual processing activities (e.g.: the data necessary for the execution of the purchase contract, until the delivery of the product or, in case of non-delivery, until the termination of the contract), it being understood that, once this term has expired, CALICANTUS may retain the data for the purposes and for the maximum retention periods illustrated in this notice and/or, in any case, in the cases established by the Regulations and/or the law.
The provision of data for the purpose in question is optional: that is, there is no legal or contractual obligation to provide the data; it is, however, a necessary requirement for the conclusion of the purchase contract through the Site: failure to provide the data will therefore result in the impossibility for the user to conclude such a contract and thus to make purchases through the Site.
4. Data processing by CALICANTUS S.R.L. for administrative accounting and tax purposes
CALICANTUS, as Autonomous Holder, will process users' data for the purpose of performing administrative and/or accounting and/or tax obligations, related to the purchase contract concluded through the Site, such as, by way of example, the keeping of accounting records and the issuance of the sales invoice.
The legal basis for this processing is the fulfillment of legal obligations to which CALICANTUS is subject (art. 6.1.c) of the Regulations).
The provision of data for this purpose is mandatory, because their processing is necessary to allow CALICANTUS to fulfill legal obligations incumbent on it. Any refusal to provide data for this purpose will result in the impossibility for the user to conclude the purchase contract through the Sites.
For this purpose, CALICANTUS will process the user's data until the expiration of the legal deadlines stipulated for the performance of each administrative-accounting and fiscal fulfillment and/or for the retention periods stipulated by law for the preservation of related documentation.
5. Data processing by CALICANTUS S.R.L. for payment purposes
CALICANTUS, as an Autonomous Holder, will not store users' credit card information. CALICANTUS maintains a relationship of a contractual nature with Payment Service Providers and/or acquirers and/or banks in order to be able to provide the order collection service. The association between CALICANTUS as seller, the user as debtor and the Payment Service Providers and/or acquirers and/or banks is done through a secret code ("token"), generated by means of modules and/or plug-ins for the e-commerce software platform of the Site provided directly by the Payment Service Providers and/or acquirers and/or banks.
Users' credit card information may also be stored and managed, subject to consent given by the user, by Payment Service Providers and/or to acquirer and/or banks for the purpose of facilitating the payment of purchases subsequent to the first, or their reimbursement, if applicable.
Link:
● Braintree https://www.braintreepayments.com/it/legal/data-protection-addendum
● Paypal https://www.paypal.com/it/webapps/mpp/ua/privacy-full
● Stripe https://stripe.com/en-it/privacy
6. Processing of data by CALICANTUS S.R.L. in order to enable the user to exercise rights
CALICANTUS, as the Autonomous Owner, will process user data for the purpose of:
● to acknowledge requests to exercise the right of withdrawal and/or requests to exercise the legal guarantee of conformity and/or other rights arising from the purchase contract concluded through the Site and/or provided by law in connection with such contract;
● To carry out such activities as may be necessary as a consequence of the exercise of such rights and to make refunds where appropriate;
● Receive and acknowledge requests to exercise personal data protection rights under the Regulations and carry out all consequent activities.
The legal basis for this processing is the fulfillment of legal obligations to which CALICANTUS is subject (art. 6.1.c) of the Regulations).
The provision of data for this purpose is obligatory, because their processing is necessary to enable CALICANTUS to fulfill legal obligations as well as the user to exercise the rights that the law or the contract gives him. Any refusal to provide data for this purpose will make it impossible for the user to exercise these rights.
For this purpose, CALICANTUS will process the data until the expiration of the legal terms provided for the exercise of the right (prescription and/or forfeiture period) or, in the case of the exercise of these rights, for the time necessary to manage and close the file; in the case of the exercise of the rights provided for in the Regulations, the data will be processed until the data controller certifies that it has fulfilled the request or until the fulfillment itself, whichever occurs last.
7. Data processing by CALICANTUS S.R.L. for purposes of establishing, exercising or defending a right
CALICANTUS, as Autonomous Holder, will process user data for the purpose of establishing, exercising or defending a right in all relevant venues.
The legal basis for this processing is legitimate interest (Art. 6.1(f) of the Regulations).
It is the legitimate interest of the data controller to pursue remedies to ensure compliance with its contractual rights or to demonstrate that it has fulfilled its obligations arising from its contract with the data subject or imposed on the data controller by law. This legitimate interest is, in turn, grounded in the constitutionally protected right to defense. It can therefore be deemed to prevail over the fundamental rights and freedoms of the data subject, also because of the data subject's reasonable expectations.
The user has, in any case, the right to object at any time, for reasons related to his or her personal situation, to the processing of personal data concerning him or her for the purpose in question (i.e. defense of a right/justice purposes).
Data subjects may exercise their rights by contacting CALICANTUS at the contact details given in Section 2 of this policy.
The user is advised that, in particular, CALICANTUS will retain and possibly use the data:
● for the purpose of proving the fulfillment of the purchase contract and/or to initiate or respond to actions related to such contract before any administrative and/or judicial authority and/or to protect its rights in the preparatory stages of the judgment and/or proceedings; for this purpose, the data will be kept for [10 years from the delivery of the product or from the termination of the contract, in case of non-delivery of the product];
● to prove that they have consented to the exercise of their rights under the Regulations and/or the law (e.g., right of withdrawal; legal guarantee) and/or the purchase contract and that they have carried out what the law and/or the contract requires in this regard (e.g., refund, in the case of exercising the right of withdrawal);
● to prove that they have responded to users' complaints and/or reports and/or grievances;
● in the event of the exercise of rights under the Regulations, the data will be retained for [5 years from the attestation that the data subject's request has been acknowledged or from such acknowledgement, whichever is later];
● in the case of the exercise of rights under the purchase contract or the law, the data will be retained for [10 years, starting from the closing of the case or the performance of the action defining it] (e.g., refund, in the case of withdrawal; or delivery of the replacement product, in the case of a legal guarantee); closing of the case means the last correspondence regarding the exercise of the rights in question);
● in the case of complaints and/or reports and/or disputes, the data will be kept for [three years from the closure of the case], to be understood as the last correspondence on the matter.
Providing data for this purpose is optional: there is no legal or contractual obligation for the data subject to provide data for this purpose. For this purpose, data collected initially for a different purpose are used, the further processing of which is permitted insofar as it is based on the legitimate interest of the data controller, given the compatibility of this further purpose with the initial purpose of the collection, also taking into account the fact that, insofar as the processing is necessary for the establishment, exercise and defense of a right, the data controller is, likewise, exempt from the obligation to delete, by express provision of the Regulations.
Indeed, in the event of the exercise of the right to object, the data controller shall refrain from further processing personal data, unless the data controller demonstrates the existence of compelling legitimate grounds for processing that override the interests, fundamental rights and freedoms of the data subject or for the establishment, exercise or defense of a legal claim.
8. Categories of subjects to whom CALICANTUS S.R.L. communicates the user's personal data (recipients)
The personal data provided by the user may be communicated by CALICANTUS to the following categories of recipients.
The persons to whom CALICANTUS communicates the data act as external data processors designated by CALICANTUS by means of a special contract ("Data Processors") or as persons authorized to process personal data under the direct authority of CALICANTUS ("Designated/Authorized/Processors") or, in the case of third parties used by the Data Processor, as "Sub-Processors", pursuant to Article 28.4 of the Regulations, except in cases where the recipient acts as an autonomous owner of the
processing, as, for example, in the case of the Payment Service Provider, or as in the case of couriers.
Users' personal data may be disclosed by CALICANTUS to the following categories of recipients:
● to employees and/or collaborators of CALICANTUS, for the performance of administrative, accounting, and IT and logistical support activities;
● to companies, consultants or professionals that may be entrusted with the installation, maintenance, updating and, in general, the management of CALICANTUS' hardware and software, including, providers of cloud computing and chat services, and to third parties they use;
● to companies that perform logistics support and/or warehousing and/or packaging and/or shipping and delivery or pickup of products purchased on the Sites and to third parties they use;
● to the Payment Service Provider and/or acquirer and/or banks in order to enable payment for purchases made on the Sites or their reimbursement, if applicable and to third parties they use;
● to all those parties, including public authorities, who have access to the data by virtue of regulatory or administrative measures.
● to all those public and/or private entities, individuals and/or legal entities (legal, administrative and tax consulting firms), if the communication is necessary or functional for the proper fulfillment of contractual obligations undertaken in relation to purchases through the Sites as well as obligations arising from the law or in the case of ascertaining, exercising or defending a right.
The list of recipients is available at the CALICANTUS office.
9. Transfers to countries non-EU
Users' personal data collected through the Site are not transferred by CALICANTUS to countries outside the EU.
10. Rights of the data subject
The data subject has the right to obtain from the data controller (and thus from CALICANTUS) in the cases provided for in the Regulation, access to personal data, rectification, integration, deletion of the same or restriction of processing or to object to such processing as well as the right to data portability (Art. 15 et seq. of the Regulation).
The request can be made, without any formality, by contacting CALICANTUS at the contact details given in Section 2 of this policy.
A data subject who wishes to make use of it can find the template for exercising personal data protection rights at the following link: https://www.garanteprivacy.it/home/modulistica-e-servizi-online#diritti
The data subject also has the right to:
● object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her carried out for the purposes set out in this policy and having as its legal basis the legitimate interest of the data controller;
● to obtain from the data controller (and thus from CALICANTUS) confirmation as to whether or not personal data concerning him or her is being processed and, if so, to obtain access to the personal data and information set out below;
● obtain from the data controller (and thus from CALICANTUS) the rectification of personal data concerning him/her without undue delay. Taking into account the purposes of the processing, the data subject has the right to obtain the integration of incomplete personal data, including by providing a supplementary declaration;
● Obtain from the data controller (and thus from CALICANTUS) the erasure of personal data concerning him/her without undue delay, and the data controller is obliged to erase personal data without undue delay, if one of the following grounds exists:
◦ personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
◦ the data subject objects to processing based on the legitimate interest of the data controller for reasons related to his or her particular situation (and, therefore, in the cases of objecting to processing for the purposes outlined in this policy);
◦ personal data are processed unlawfully;
◦ personal data must be deleted to fulfill a legal obligation.
● Obtain from the data controller (and thus from CALICANTUS) the restriction of processing when one of the following cases occurs:
◦ data are not accurate or are processed unlawfully and the data subject objects to their deletion;
◦ despite the fact that the owner no longer needs the data for processing purposes, the data are necessary for the data subject to assert a right in court.
● receive in a structured, commonly used, machine-readable format personal data concerning him or her that has been provided to a data controller;
● Transmit the data to another data controller without hindrance from the controller to whom he or she provided the data, if the processing is based on consent or a contract with the data subject and is carried out by automated means.
Data subjects may exercise their rights by contacting CALICANTUS at the contact details given in Section 2 of this policy.
In the event that the right is exercised, the controller shall refrain from further processing the personal data, unless the controller demonstrates the existence of compelling legitimate grounds for processing that override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of a legal claim.
11. Time and manner of response in case of exercising the rights of the data subject
The data controller shall provide the data subject with information about the actions taken in relation to a request to exercise the rights recognized by Articles 15 to 22 of the Regulation (i.e. right of access, right to rectification, right to erasure, right to restriction of processing, right to data portability, right to object) and referred to in Section 7 of this notice ("Rights of the Data Subject"), without undue delay and, in any case, within one month of receipt of the request. This deadline may be extended by two months, if necessary, taking into account the complexity and number of requests. The data controller shall inform the data subject of such extension, and the reasons for the delay, within one month of receipt of the request. If the data subject makes the request by electronic means, the information shall be provided, where possible, by electronic means, unless otherwise specified by the data subject.
If the data controller fails to comply with the data subject's request, the data controller shall inform the data subject without delay, and at the latest, within one month of receipt of the request, of the reasons for non-compliance and of the possibility of lodging a complaint with a supervisory authority and seeking judicial remedy.
Communications in response to the exercise of the Data Subject's Rights and actions taken are free of charge. If the data subject's requests are manifestly unfounded or excessive, particularly because of their repetitive nature, the data controller may:
● Charge a reasonable fee, taking into account the administrative costs incurred in providing the communications or taking the requested action;
● Refuse to comply with the request.
When the data controller has reasonable doubt about the identity of the natural person making the request regarding the Data Subject's Rights, it may request additional information necessary to confirm the identity of the data subject.
12. Right to file a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, a data subject who considers that processing concerning him or her is in violation of the Regulation has the right to lodge a complaint with a supervisory authority, namely in the Member State where he or she normally resides, works, or of the place where the alleged violation occurred. The supervisory authority to which the complaint is made shall inform the complainant of the status or outcome of the complaint, including the possibility of a judicial remedy.