Information Document – Article 13 of the EU Regulation 2016/679 – GDPR – Information Regarding the Processing of Personal Data Collected from the Data Subject/User and Article 130 – Unwanted Communications of Legislative Decree 196/2003 – Contractor.
DATA PROCESSED
Personal Data: any information related to an identified or identifiable natural person (“data subject”); a natural person is considered identifiable if they can be identified directly or indirectly, especially with reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more elements specific to their physical, physiological, genetic, psychological, economic, cultural, or social identity.
Data of contractors/users.
For browsing data and cookies, please refer to the privacy policy in the website’s footer.
1. DATA CONTROLLER
According to Articles 4 and 24 of the GDPR, the Data Controller is Boffi S.p.A., located at Via Oberdan 70, 20823 Lentate sul Seveso (MB), represented by the legal representative pro tempore. The contact email for the Data Controller is privacy@boffi.com.
2. DATA PROTECTION OFFICER (DPO) The DPO has been appointed in accordance with Articles 37–39 of EU Regulation 2016/679. The DPO’s contact email is dpo.boffi@dpoprofessionalservice.it.
3. PURPOSE OF THE DATA PROCESSING, LEGAL BASIS, AND DATA RETENTION PERIOD
| PURPOSE | LEGAL BASIS | DATA RETENTION PERIOD |
| A) Browsing on this website using cookies and equivalent technologies as per the cookie policy and third-party cookies and technologies. | Article 6, para. 1(f) GDPR – Legitimate interest of the Data Controller: ensuring proper navigation of the website. For profiling cookies, processing is based on consent to the processing of personal data (C42 C43), Article 6, para. 1(a) of GDPR, consent provided via the site’s cookie banner. | Please refer to the cookie policy in the site’s footer. |
| B) Direct marketing for sending advertising or direct sales materials or conducting market research, satisfaction surveys, or commercial communication and newsletters via automated means (e.g., email or social networks and sponsorships) and traditional means (e.g., operator-assisted calls and postal mail, also through Data Processors) for products of the BOFFI, DE PADOVA, and ADIELLE brands. For a complete list, request it at privacy@boffi.com | There will be no transfer of personal data to third-party partners for this purpose. The Data Controller may use newsletter sending systems and promotional communication tools with reports to compare and potentially improve the effectiveness of communications. Reports allow the Data Controller to know, for example: the number of readers, unique openers, and clicks; the devices and operating systems used to read the communication; the details of user activities; details of emails sent, delivered, and bounced; etc. All this data is used to compare and improve communication effectiveness. | The processing is based on consent to the processing of personal data (C42 C43), Article 6, para. 1(a) GDPR. |
| C) Profiling: personal data will be entered into the company’s CRM platforms for internal analysis to group individuals based on specific company activity characteristics for better service management and targeted promotional communication. | The processing is based on consent to the processing of personal data (C42 C43), Article 6, para. 1(a) GDPR. | Until consent is withdrawn (opt-out) and, in any case, for a maximum of 5 years. |
4. RECIPIENTS OR CATEGORIES OF RECIPIENTS OF THE DATA
The personal data provided will be communicated to recipients who will process the data as data processors (Article 28 of EU Regulation 2016/679) and/or as natural persons acting under the authority of the Data Controller and Data Processor (Article 29 of EU Regulation 2016/679) or to individuals acting as independent controllers for the purposes outlined in point 3. Specifically, data will be communicated to: entities providing services for the management of the information system used by Boffi S.p.A. and telecommunications networks (including email and platforms); firms or companies providing assistance and consulting services; social media platforms; Boffi Group companies that are subsidiaries, affiliates, or otherwise contractually linked to Boffi S.p.A., or part of its distribution and sales network (such as branches, importers, distributors, resellers, shippers, etc.), possibly also located in countries outside the European Union; competent authorities to fulfill legal obligations and/or requirements from public bodies. The list of data processors is constantly updated and available upon request at privacy@boffi.com or at Boffi S.p.A. headquarters at Via Oberdan 70, 20823 Lentate sul Seveso.
5. DATA TRANSFER TO A THIRD COUNTRY AND/OR INTERNATIONAL ORGANIZATION AND GUARANTEES
The website is hosted in EU countries. Personal data provided may be transferred to EU countries and non-EU countries for purposes connected to the above. Data will be transferred based on:
- Article 44 – General principle for transfers.
- Article 45 – Transfer on the basis of an adequacy decision.
- Article 46 – Transfer subject to appropriate safeguards. To obtain information about the guarantees regarding data transfer outside the EU, write to privacy@boffi.com.
6. NATURE OF DATA PROVISION AND REFUSAL
Users/contractors are free to provide their personal data, and failure to do so may only result in the inability to obtain the requested information or services provided through this website. Providing personal data for purposes B) and/or C) is optional and will not affect the purposes outlined in point A). Marketing activity is only optional and will be carried out only with the specific consent of the data subject. Entering data into the CRM is optional and will automatically make it visible to those who have access, i.e., authorized processors and personnel at sales points worldwide.
7. DATA SUBJECT RIGHTS (Natural Persons)
You may exercise your rights as expressed in the EU Regulation 2016/679 by contacting the Data Controller via email at privacy@boffi.com or the DPO at dpo.boffi@dpoprofessionalservice.it. You have the right to request access to your personal data (Article 15), rectification (Article 16), or deletion (Article 17) of your data, restriction of processing (Article 18), or to object to processing based on legitimate interest (Article 21). You also have the right to data portability (Article 20). If processing is based on consent, you have the right to withdraw consent at any time without affecting the lawfulness of the processing based on consent before withdrawal. To object to processing or exercise other rights, write to dpo.boffi@dpoprofessionalservice.it. To withdraw consent for non-automated profiling, simply send an email at any time to dpo.boffi@dpoprofessionalservice.it with the subject “no profiling.” If you believe that your data processing violates the provisions of EU Regulation 2016/679, you have the right to lodge a complaint with the supervisory authority – the Italian Data Protection Authority (https://www.garanteprivacy.it/).
8. CHANGES TO THIS PRIVACY NOTICE
The Data Controller reserves the right to modify, update, add, or remove parts of this privacy notice. It is the responsibility of the data subject to periodically check for changes. To facilitate this verification, the notice will include the date of the last update. Use of the website after the publication of changes will constitute acceptance of those changes.
Last updated: September 11, 2024.