Privacy policy
This Privacy Policy applies in all cases where users access the website, decide to browse it, and use its services, regardless of purchasing products. It provides all necessary information to understand how data and information identifying users of http://www.gheta.com and all related Gheta® websites are collected and used. For the purposes of personal data processing regulations, these users are referred to as "data subjects."
Information pursuant to Article 13 of EU Regulation 2016/679
This information is provided solely for the above-mentioned website owned by INTERCOMM S.R.L. and not for any third-party websites accessed through links.
DATA CONTROLLER
The data controller of the data collected through this website is INTERCOMM S.R.L. (hereinafter also referred to as "INTERCOMM S.R.L."), with registered office in Italy, Via Trieste, 126b – 31030 Arcade (TV). It independently determines the purposes and methods of processing and the security measures to be applied to ensure the confidentiality, integrity, and availability of the data.
DATA PROTECTION OFFICER (DPO)
INTERCOMM S.R.L. has appointed a Data Protection Officer (DPO), who can be contacted at the following email address: info@gheta.com.
PURPOSES OF DATA PROCESSING
The collected data may be processed for the following purposes:
- Registration on the website to use services offered by INTERCOMM S.R.L. and management of the related account;
- Management and execution of purchase orders, including returns and complaints;
- Management of payment methods for product purchases on INTERCOMM S.R.L.'s website;
- Handling user requests: technical, commercial, order tracking, and information inquiries;
- Receipt of CVs;
- Sending newsletters;
- Sending marketing and/or commercial communications via various channels, both electronic (email, SMS) and traditional (postal mail);
- Data collection: a) on the shopping experience and purchased products, with the consequent publication of reviews on INTERCOMM S.R.L.'s website and social media channels; b) on purchasing preferences, including participation in surveys to personalize commercial communications.
DATA PROCESSING METHODS AND RETENTION PERIOD
Personal data will be processed primarily through electronic and telematic means. Processing operations will be implemented to ensure the logical, physical security and confidentiality of personal data acquired through this website.
Data will be retained for the period strictly necessary to achieve the purposes for which they were collected, namely:
- Registered user data and account information: Until deletion is requested. After 10 years of inactivity, the registered user will be contacted to confirm the account registration. If no confirmation is received, the account will be deactivated, and data deleted.
- Data collected for purchase orders: Until the order is fulfilled and, in any case, for 10 years from the purchase order date.
- Billing and payment data (if any): 10 years.
- Data related to handling user requests: As long as necessary to fulfill the request.
- CV data: 12 months.
- Newsletter subscription data: Until consent is revoked. If the account remains inactive for 5 years, test emails will be sent. If inactivity persists after two test emails, data will be permanently deleted.
- Marketing communications based on legitimate interest: Until the right to object is exercised.
- Reviews on shopping experience and purchased products: 12 months.
- Survey data for personalized commercial communications: 12 months unless consent is revoked earlier.
CHANGES TO THE POLICY
The data controller reserves the right to modify this privacy policy at any time, informing users through notifications sent to available contact details.
LEGAL BASIS AND NATURE OF DATA PROVISION
Providing personal data to INTERCOMM S.R.L. may be mandatory or optional.
The legal basis for processing:
- For purposes 1 to 4: Contractual necessity. Without this data, orders cannot be processed, and services cannot be used.
- For purpose 5: Processing of CVs is lawful under Article 111-bis of Legislative Decree 196/2003 without requiring explicit consent.
- For purposes 6, 7, and 8: Consent is required. Without consent, newsletters, commercial communications, and personalized communications based on surveys will not be sent.
- Soft spam: If a user has previously engaged in a transaction with INTERCOMM S.R.L., the company may send commercial communications regarding similar products or services without specific consent unless the user objects.
MARKETING CAMPAIGNS AND PROFILING
INTERCOMM S.R.L. conducts personal data processing for digital marketing campaigns. The legal basis is user consent obtained through cookie acceptance, which can be revoked via browser settings or the cookie banner.
Through digital platforms, INTERCOMM S.R.L. may display marketing content and advertisements based on user interests, profiling data acquired on its website, and shared with digital platforms.
Users' personal data may also be collected when interacting with INTERCOMM S.R.L.'s social media pages. Users are encouraged to review the privacy policies of different social media platforms.
DATA DISCLOSURE AND SHARING
We may engage third parties to facilitate our service, perform related services, or assist in usage analysis. These third parties have access to personal information only to perform these tasks on our behalf and are obligated not to disclose or use them for any other purpose.
Collected data may be shared with:
- Legal authorities when required by regulations;
- Financial administrations and public entities in compliance with legal obligations;
- Employees and collaborators tasked with handling provided data;
- Third parties selected based on expertise, capacity, and reliability to ensure compliance with data security laws. These third parties act as "data processors" under INTERCOMM S.R.L.'s instructions.
DATA TYPES PROCESSED
- Browsing Data: Includes IP addresses, domain names, and technical information used for statistical analysis and website security.
- Personal Data: Includes name, surname, email address, delivery address, billing data (if applicable), username, password, survey responses, and purchase preferences.
- Cookies: Used in accordance with INTERCOMM S.R.L.'s Cookie Policy.
SECURITY MEASURES
INTERCOMM S.R.L. has adopted adequate security measures to minimize the risk of data destruction, loss, unauthorized access, or processing inconsistent with the purposes of collection.
MINORS' PRIVACY
Our services are not intended for individuals under 18. If we become aware that a minor has provided personal data, we will delete such information immediately.
THIRD-PARTY LINKS
Our service may contain links to third-party websites. We advise reviewing their privacy policies as we do not control their content, privacy policies, or practices.
RIGHTS OF THE DATA SUBJECT pursuant to Articles 15, 16, 17, 18, 20, 21, and 22 of REG. EU 2016/679
We inform you that, as a data subject, in addition to the right to lodge a complaint with a supervisory authority, you also have the rights listed below, which you may exercise by submitting a specific request to the Data Controller.
Article 15 - Right of access
The data subject has the right to obtain confirmation from the data controller as to whether or not personal data concerning them are being processed and, if so, to access the personal data and information regarding the processing.
Article 16 - Right to rectification
The data subject has the right to obtain from the data controller the rectification of inaccurate personal data concerning them without undue delay. Considering the purposes of the processing, the data subject also has the right to have incomplete personal data completed, including by providing a supplementary statement.
Article 17 - Right to erasure (right to be forgotten)
The data subject has the right to obtain from the data controller the erasure of personal data concerning them without undue delay, and the data controller is obliged to erase such data without undue delay.
Article 18 - Right to restriction of processing
The data subject has the right to obtain from the data controller the restriction of processing where one of the following applies:
a) The data subject contests the accuracy of the personal data, for the period necessary for the data controller to verify the accuracy of such data;
b) The processing is unlawful, and the data subject opposes the erasure of the personal data and instead requests the restriction of their use;
c) The data controller no longer needs the personal data for processing purposes, but the data are required by the data subject for the establishment, exercise, or defense of legal claims;
d) The data subject has objected to processing pursuant to Article 21(1), pending verification of whether the legitimate grounds of the data controller override those of the data subject.
Article 20 - Right to data portability
The data subject has the right to receive the personal data concerning them, which they have provided to a data controller, in a structured, commonly used, and machine-readable format and has the right to transmit those data to another data controller without hindrance from the controller to whom the personal data have been provided.
In exercising their right to data portability under paragraph 1, the data subject has the right to have the personal data transmitted directly from one controller to another, where technically feasible.
Article 21 - Right to object
The data subject has the right to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them under Article 6(1)(e) or (f), including profiling based on those provisions.
Article 22 - Right not to be subject to automated decision-making, including profiling
The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.
Article 7 - Withdrawal of consent to processing
The data subject also has the right to withdraw their consent to the processing of their personal data.
Upon completion of this operation, their personal data will be removed from the archives as soon as possible.
If you would like more information on the processing of your personal data or wish to exercise the rights mentioned above, you can write to: info@gheta.com.
Before providing or modifying any information, it may be necessary to verify your identity and answer a few questions. A response will be provided as soon as possible, within a maximum of 30 days from the request.
Requests may also be addressed to the Data Controller at:
INTERCOMM S.R.L.
Via Trieste 126b - 31030 Arcade (TV) Italy