Information pursuant to art. 13 of the Rules (EU) 2016/679 on the protection of personal data (GDPR) and request for consent for the processing of personal data collected from the interested party and pursuant to art. 13 Legislative Decree 196/2003

The company DRC S.r.l. with registered office in La Valletta Brianza (LC)  Via V. Veneto, 23, whose contact data are the following:

Tel. 0362-569557 – Fax. 0362- 567415

Mail: CERCHITALY@DRC.IT

intends to inform you pursuant to Art. 13 of EU 2016/679 Rules (hereinafter referred to as “Rules”) or pursuant to article 13 of Legislative Decree 196/2003, collectively referred to as Applicable Law, that DRC is the data controller of the personal data that will be provided and that will proceed to the relative processing for the purposes and according to the methods indicated below.

Please note that this information is provided only for the website www.drc.com (“Website”) and the blog linked to it, while it does not apply to other websites that may be consulted through external links and is intended as a Notice pursuant to art. 13 of the Applicable Law to those who interact with the Site or with the blog connected to it, all according to Recommendation n. 2/2001 concerning the minimum requirements for online data collection in the European Union, adopted on 17th  May 2001 by the Article 29 Working Group.

Index:

1. Purpose and legal basis of processing

2. Recipients of personal data

3. Data transfer to third countries

4. Data retention period

5. Obligation / right to provide personal data

6. Rights of the interested party

1 – Purpose and legal basis of processing

Your personal data will be processed for the following purposes:

a) to conclude a contract concerning the products and / or services made by DRC;
b) to fulfil the pre-contractual, contractual and tax obligations deriving from existing relations with you;
c) to fulfil the obligations established by law, by a Rules, by the Community legislation or by an order of the Authority;
d) to assert or defend a right in court, as well as in administrative or arbitration and conciliation procedures in the cases provided for by law, community legislation, Rules;
e) direct marketing and market research;
f) profiling related to the sector in which DRC operates.

The processing referred to in the above letters a), b), c), d) is necessary for the provision of the service requested by the user with the consequence that DRC is not obliged to acquire the specific consent to the processing of data as the legal basis of the processing of your personal data for the purposes indicated above is the art. 6 (1) (b) of the Rules (“[…] processing is necessary for the execution of a contract of which the party concerned is a party or for the execution of pre-contractual measures taken at the request of the same”) and art. 6 (1) (c) of the Rules (“[…] processing is necessary to fulfil a legal obligation to which the data controller is subjected”).

Concerning the processing referred to in the above letters (e) (marketing purposes) and f) (profiling purposes), they require your express consent by affixing specific “flags”.

It should be noted that the direct marketing activity (carried out by DRC) aims to collect and use pertinent data limited to what is necessary with respect to the purpose for which they are processed, to elaborate studies, research and send advertising and information material, perform direct sales or placing of products or services, send commercial information, make interactive commercial communications.

The profiling activity consists, instead, in the collection of information on the behaviour and commercial habits in the bicycle sector in order to improve the services offered according to the needs of customers who have expressed specific consent.

With reference to marketing and profiling activities, it should be noted that, in case of lack and non-specific consent to the processing by the user, it would not be possible to perform the aforementioned activities.

2 – Recipients of personal data

The Personal Data may be communicated, for the purposes specified in point 1, to predetermined recipients with whom specific tasks and / or contracts have been signed that also regulate the processing of data on our behalf and impose confidentiality obligations, among which:

1. employees and collaborators authorized by DRC to the processing of personal data that are committed to confidentiality or have an appropriate legal obligation of confidentiality;

2. companies or professional firms, which provide assistance, advice or collaboration in accounting, administrative, legal, tax and financial matters with which a contract has been concluded pursuant to and for the purposes of Article 28 of the Rules;

3. third-party companies that deal with the management of the blog and / or marketing campaigns with which a contract has been concluded pursuant to and for the purposes of Article 28 of the Rules;

In any case, personal data may be disclosed to jurisdictional authorities in the exercise of their functions when required by the Applicable Law.

For the subjects indicated under nos. 2 and 3 only the category of recipients is indicated, as it is the object of frequent updates and revisions. Therefore, interested parties may request an updated list of recipients by contacting the Data Controller through the channels indicated in art. 1 of this information.

3 – Data transfer to third countries

Some of your Personal Data is transferred to Recipients that could be outside the European Economic Area. DRC ensures that the electronic and paper processing of your Personal Data by the Recipients takes place in compliance with the Applicable Laws, all in compliance with the principles set out in Articles 45 and 46 of the GDPR concerning the existence of an adequacy decision by the European Commission or adequate guarantees.

4 – Data retention period

Personal data will be kept for the period strictly necessary to pursue the specific purposes of the processing for which the user has expressed his consent and, specifically:

• for the purposes indicated in letter a), b), c), d) of the above points 1 for the time necessary to fulfill the contractual obligations and, in any case, no later than 10 years from the time of collection of your data for fulfilment of regulatory obligations and, in any case, not beyond the deadlines set by law for the prescription of rights;

• for the purposes indicated in letter e) (or for direct marketing purposes) of the above point 1 for 24 (twenty-four) months from the moment of consent to the processing;

• for the purposes indicated in letter f) (or for purposes of profiling) of the above point 1 for 12 (twelve) months from the moment of consent to the processing.

5 – Obligation / right to provide personal data

DRC specifies that the communication of data for the purposes referred to in above letters a), b) c), d), derives from a legal obligation and / or necessary for the conclusion of the contract and that in case of non-communication DRC cannot proceed with the execution of the contract.

With regard to the data communicated for the purposes referred to in above letters (f) (marketing purposes) g) (profiling purposes), it is specified that communication is optional and that DRC will be authorized to process only upon collection of the consent given by the interested party.

6 – Rights of the interested party

You may, at any time, exercise the rights indicated below, and in particular:

1. Access to personal data: obtain confirmation of whether data concerning you are being processed and, in this case, access to the following information: the purposes, the categories of data, the recipients, the retention period, the right to lodge a complaint with a supervisory authority, the right to request the correction or cancellation or limitation of processing or opposition to the processing itself as well as the existence of an automated decision-making process;

2. Request for rectification or cancellation of the same or limitation of the processing that concerns you; “limitation” means the marking of data stored with the aim of limiting its processing in the future;

3. To oppose the processing: to oppose for reasons connected to your particular situation to the processing of data for the execution of a task of public interest or for the pursuit of a legitimate interest of DRC;

4. Data portability: in case of automated processing carried out on the basis of consent or in execution of a contract, to receive data concerning him in a structured format, commonly used and readable by automatic device; in particular, the data will be provided by the Data Controller in .xml format, or similar;

5. Revocation of consent to processing for marketing purposes, both direct and indirect, market research; the exercise of this right does not prejudice in any way the lawfulness of the processing carried out before the revocation;

6. Propose a claim pursuant to art. 77 GDPR to the competent supervisory authority based on your habitual residence, place of employment or place of violation of your rights; for Italy, the Guarantor for the protection of personal data is the competent authority and can be contacted via the contact details on the website http://www.garanteprivacy.it.

The aforementioned rights may be exercised by sending a specific request to the Data Controller through the contact channels indicated in art. 1 of this information.

Requests relating to the exercise of user rights will be processed without unjustified delay and, in any case, within one month of the request; only in cases of particular complexity and of numerous requests can this term be extended by a further 2 (two) months.