The Data Controller processes personal identifying data communicated by you, such as your name and surname, telephone number, email address and billing data, hereafter also referred to as “personal data” or “data”. Data relating to payment methods (i.e. credit card numbers) are not stored in any way.

Your personal data may be used for the following purposes:

Without your express consent, as per Article 6, Letters b), e) and f) of the GDPR, for the following Service Purposes:

• To stipulate contracts for services offered by the Data Controller, and to fulfil pre-contractual, contractual and tax obligations deriving from relationships with you; in particular:
• To allow registration on the Site and the use of services reserved for registered users, including the possibility of purchasing online through the Site;
• To allow the stipulation of the purchase contract through the Site and the correct execution of obligations arising from this contract, such as, by way of example, the delivery and payment, also online, of the products purchased;
• To allow assistance and customer care activities, and therefore respond to requests for information from users or to respond to complaints, reports and disputes, in addition to allowing the user, if they wish to do so, to give feedback or leave a review;
• To fulfil requests and respond to messages sent by the user;
• To fulfil obligations established by law, regulations, European Community legislation and any order of an authority, such as, for example, concerning money laundering;
• To exercise the rights of the Data Controller, for example, the right of defence in court;

Only with your specific and express consent (as per Article 7 of the GDPR), for the following Marketing Purposes:

• To communicate via e-mail, post, text message and/or telephone contact newsletters, commercial communications and/or advertising materials regarding products or services offered by the Data Controller, and to evaluate the degree of satisfaction with the quality of its services;
• To relay commercial and/or promotional communications from third parties via e-mail, post, text message and/or telephone contact.

The processing of your personal data is carried out using the methods referred to in Article 4, Point 2) of the GDPR, precisely: collection, registration, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, limitation, communication, cancellation and destruction of the data. Your personal data is processed in paper, electronic and/or automated form.

The Data Controller will process the personal data for the time necessary to fulfil the aforementioned purposes, and, in any case, for no more than 10 years from the termination of the relationship for the Service Purposes, and no more than 2 years from the collection of the data for the Marketing Purposes.

CMC Ventilazione S.r.l. will process the personal data in the case of payments for purchases made on the Site by credit card in order to manage and possibly block payment transactions relating to fraudulent orders, possibly identified through the monitoring of user behaviour and the creation of user profiles. This processing will take place using an anti-fraud computer system in a completely automated way, and also with the aid of systems provided by an external data processor.

Your data may be made accessible, for the purposes referred to in point B above, to employees and contractors of the Data Controller, in their capacity as appointed data processors, internal data processors and/or system administrators, and to external data processors in order to allow the processing of payments for products purchased through the Site.

No data related to the web service (including the navigation data specified above and/or cookies) is communicated or disseminated (except for communication to any judicial or police bodies if necessary).

Without the need for express consent, as per Article 6, Letters b) and c) of the GDPR, the Data Controller may communicate your data for the purposes referred to in point B.1 to Supervisory Bodies, Judicial Authorities, insurance companies for the provision of insurance services, and all subjects to whom communication is mandatory by law for the fulfilment of the aforementioned purposes. These subjects will process the data in their capacity as independent data controllers.

The personal data is stored on a server under the domain sauron.misterketing.it, with IP address 167.235.48.159, located in Nuremberg, Germany, and therefore within the European Union.

The provision of the data for the purposes referred to in point B.1 (Service Purposes) is mandatory. Without such data, we will not be able to guarantee you the Services referred to in point B.1.

The provision of data for the purposes referred to in point B.2 (Marketing Purposes) is instead optional. You may therefore decide not to provide any data or to withdraw, at a later time, your consent to process the data previously provided for such purposes. In this case, you will no longer receive newsletters, commercial communications or advertising materials relating to the services offered by the Data Controller. However, you will continue to be entitled to the services referred to in point B.1.

In your capacity as the Data Subject, you have access rights to your data as per Articles 15–22 of the GDPR, i.e. the right of access, the right of rectification, the right of cancellation (“right to be forgotten”), the right of limitation of the processing, the right to data portability, the right to opposition of the processing, and the right of lodging a complaint with the privacy or data protection authority.

You may exercise your rights at any time by sending an e-mail to info@cmcventilazione.com.

As the Data Subject, you have the right to lodge a complaint with the supervisory authority of your state of residence.

The Data Controller does not carry out processing that consists of automated decision-making processes.

The Data Controller is CMC Ventilazione S.r.l., with registered office in Via Vienna, 46, 24040 Verdellino (BG), Italy.