1. FOREWORD

This Privacy Policy should not be considered as a stand-alone text, but is integrated and completed with the other texts on the Service, and in particular with the Terms and Conditions of Browsing and the Privacy Policy on the Processing of Personal Data through the Use of Cookies.

This notice will attempt to explain to the user who and how the data of the data subject (also referred to in this notice as the User) are processed, what his/her data are, and what his/her rights are and how she/he can exercise them. For particular clarifications, if the user does not understand or does not consider what is included in the information notice to be sufficient, he or she is invited to write to the following address: info@castal.net

2. SOME IMPORTANT NOTIONS ABOUT PERSONAL DATA

What is meant by personal data?

Personal data is any information that refers to an identifiable natural person. First name and surname are personal data, to be precise they are identification data, but they are not the only personal data of the user. There are in fact others in the communication between the User and Castal srl: e-mail, text of the message in the Contacts section, etc.

But that’s not all: since personal data are, as said above, the information that refers to a natural person, the very content of the communications sent to Castal srl or published by the User on the site (in the Contacts section) may contain personal data, i.e. information, relating to the user or to third parties. For example, writing a message for a request for information that at the same time contains information about yourself is tantamount to providing Castal srl with data.

Personal data are only those of natural persons (i.e. in the case of the form in this service: name and contact e-mail, the latter only if it is the personal e-mail of the writer and not if it is the one generally assigned to the company such as info@castal.net or to an office of the same such as personale@xxx.com).

What does it mean to process data?

The legal definition of processing includes any operation or set of operations concerning the collection, recording, organisation, storage, consultation, processing, modification, selection, retrieval, comparison, use, interconnection, blocking, communication, dissemination, erasure and destruction of data. Practically everything, therefore, that can be done with user data is processing. Already, therefore, collecting or reading data for instance, i.e. consulting them, is processing. Just as it is processing, in the case of Castal srl, to process the information contained in the request in order to respond to it.

Why are they important for the user?

The data tell who the user is and what she/he does. They are hers/his, therefore, precisely because they are hers/’his’, they are important, and it is also clear that as hers/’his’ she/he has the right to decide whether to let third parties process them, and to know how this is done.

Perché sono importanti per Castal srl e per i suoi servizi collegati?

They are important because they make it possible to provide the required service.

3. WHO PROCESSES THE DATA

The data controller is the person who takes the decisions on how to process the data, i.e. – among other things – what precautions to take to protect them, where to store them (whether on a server or in the cloud, etc.), what data to ask from the user, what to process and for what purpose, what and to whom to pass them on, how to manage the users’ relations and rights, who to choose as collaborator, manager or simple appointee to process the data, what instructions to give to collaborators, etc. Therefore, since the data controller is very important, let the user know that it is:

–

CASTAL S.R.L.

Via Strada Striaga, 4

25024 Leno (BS) Italy

VAT: 00558050985

Tel: +39 030.906382

E-mail: info@castal.net

PEC: castalsnc@legalmail.it

–

Then, regarding any ancillary functions, Castal srl may make use of internal persons authorised to process data (also called data processors) or external persons mostly as data controllers. For the provision of the service Castal srl avails itself of the collaboration of various external data processors, a list of which can be obtained by emailing the following address: info@castal.net

4. TO WHOM THE DATA ARE DISCLOSED AND WHO HAS ACCESS TO THEM

The data may be disclosed to parties who collaborate in tax management (e.g., accountants).

The data is also disclosed for the purpose of performing the functions referred to in the preceding paragraph to the parties named therein (hosting, etc.).

The data is also communicated to parties that collaborate in the execution of the contract, such as banks, payment institutions or services if applicable, and express couriers for delivery.

It is important to know that Castal srl can only manage and dominate the data stored and processed within its own system: data transferred or communicated to third parties will be, in the manner and to the extent, independently processed by the third parties to whom they are communicated according to their own privacy policies. In any event, where Castal srl ceases to process a user’s personal data, it will also notify the parties to whom such data has been communicated of the termination but cannot guarantee the cessation of processing by them.

5. WHERE ARE THEY PROCESSED

Castal srl processes personal data at its premises.

Personal data, as far as hosting is concerned, are processed on EU territory, and more precisely in Italy.

6. WHAT DATA ARE PROCESSED

Based on the significant quality of the data, one can identify:

• Identifying data: first name, surname, e-mail, company.
• Content data: this is information that can be inferred or read from the content of the Contact section, (comments or requests sent to Castal srl may contain information about the person).
• Analytical statistics data: this is aggregated data, processed by fingerprinting techniques (currently cookies). A kind of survey obtained by combining the data as given above. They can have technical or statistical significance.
• Users’ navigation data, the transmission of which to the site is implicit in the operation of the computer systems responsible for its management, such as IP addresses, the domain names of the computers used by users connecting to the site and other parameters relating to the operating system.

 7. FOR WHAT PURPOSES THEY ARE PROCESSED, INDICATION OF THE LEGAL BASIS AND DURATION OF STORAGE

Castal srl processes user data for the following purposes:

• Response to user-submitted requests (information, etc.): this consists of responding to contacts made by the customer (by e-mail, chat, etc.). It consists, for example, in providing information, sending quotes, etc. Legal basis: execution of pre-contractual measures (such as information, quotes sent for the conclusion of a possible contract); Duration: ten years (obligation to keep business correspondence).
• Database creation: creation of a customer database at the holder’s premises in which users are entered and recorded. Legal basis: legitimate interest of the owner in the preservation of customer records to ensure business continuity and effective satisfaction of customer rights. Duration: for a period of time not exceeding the purposes for which the data were collected and processed.

8. HOW THE DATA ARE CONFERRED (BY THE USER)

All data are provided by the user. Name, surname, e-mail, company, contents, image are in fact those written by the same in the Contact form.

In addition to the data conferred by the user when filling in the form, there are the data that can be obtained by analysing the content of what the user has written. Well, these are data that the user confers with an active behaviour, even if perhaps in a way he/she is not very aware of, but if processed, they can assume a different and greater value than he/she believes, since they could, if processed, synthesise, profile and categorise him/her.

9. WHICH DATA ARE COMPULSORY AND WHICH ARE OPTIONAL (AND THE CONSEQUENCES OF A REFUSAL TO PROVIDE DATA)

The only data required is user identification, i.e., first name, surname and contact details (e-mail, which can, however, be company e-mail such as info@castal.net).

Failure to provide such data makes it impossible for the User to execute the Contact request.

Finally, there are the physiological ones: these are the data defined above as content data. As for the latter, it is not possible to discriminate between compulsory and optional, as they are formed as a natural consequence of writing the content of the message or comment.

10. HOW THEY ARE TREATED

Data are collected and processed by electronic means.

They are hosted on servers located in the EU (Italy), with security systems applied according to the HTTPS protocol.

Only duly authorised persons with individual authentication credentials may access and process the data within the scope of their assignment.

11. HOW LONG THEY ARE TREATED

Data are processed for as long as they serve the purpose for which they are provided, without prejudice to storage obligations laid down by law (e.g., ten-year storage of communications with fiscal or commercial content – see, among others, Presidential Decree 600/19773).

For the duration for individual purposes, however, see point no. 7.

12. WHAT IS THE LEGAL BASIS OF THE PROCESSING

The data are processed essentially to allow navigation of the site, to perform legal obligations related to it. In some cases, they are processed according to consent or legitimate interest. See point 7 for a detailed explanation.

13. WHAT ARE THE RIGHTS OF USERS

Users are beneficiaries of a number of rights.

Information rights about:

• Categories of data are processed (see points 2 and 6);
• Origin of the data, i.e. where the service got its data from (see point no. 8);
• Purpose of data processing, i.e., for what purposes the data are processed (see point no. 6);
• Modalities of data processing (see point no. 10);
• Contact details of the data controller and of any data processors (see point no. 3);
• Persons to whom the data are disclosed (see point 4);
• Storage time and data processing (see points 11 and 7);
• Right to lodge a complaint before the Privacy Guarantor by accessing the following link: https://www.garanteprivacy.it/home/diritti/come-agire-per-tutelare-i-nostri-dati-personali
• Existence or non-existence of profiling process;
• Legal basis for processing (see points 12 and 7);
• Interests pursued by the data controller through processing: economic promotion of services and sale of products related to Castal srl.

Then there are rights that are not merely informative but operational.

They are of various kinds. In summary:

• The data subject has the right to a copy of the data he or she has provided. If the data have been processed by automated methods and based on your consent or a contract, you may request – if technically possible – that the data be passed on to the same data subject or even to a possible new data controller (portability), provided that this operation does not infringe the rights (and data) of other persons. This right cannot therefore be exercised in this case in relation to communications containing data of third parties, trade secrets or otherwise protected content. In that case, he may also request the deletion of the data (unless the law requires the Data Controller to retain it, as in the case of commercial communications).
• If the personal data are inaccurate or incomplete, the data subject may ask for them to be corrected or completed and provide indications to that effect. If the data controller has to verify the accuracy of the data contested by the data subject, the data subject may in the meantime obtain the restriction of the contested data (restriction means that the data is only stored and no further processing is carried out, except with the specific consent of the data subject or if it serves to exercise or defend a right in court).
• If the personal data are no longer necessary for the purposes for which they were collected or otherwise processed, the data subject may request their deletion. If, however, the data subject needs the data in order to exercise his or her right in court, he or she may request that the data be restricted (i.e., stored only).
• If the processing is unlawful, because the data are processed in the absence of consent, a legitimate interest on the part of the Data Controller, a contract for the performance of which the processing is necessary, or a legal obligation to process the data on the part of the Data Controller, the data subject may request their deletion or restriction.

14. HOW TO EXERCISE THEM

Procedure for exercising rights

Your rights may be exercised by sending an e-mail to info@castal.net.

The Controller must reply within thirty days (which may be extended by a further two months, but in this case the Controller must give the user reasoned notice of the delay).

The Controller may refuse, if he has reason to do so, to comply with the user’s request (refusal to be communicated to the user within one month) only in the case of manifestly unfounded or repetitive requests. He must give a reasoned answer in that case. In any case, the user may appeal to the “Garante Privacy” (see link below) or to the Judge.

The Controller must respond using the same channel (email, telephone, etc.) used by the user for the request, unless the user himself requests a response by a different route. In the event of a request coming from an e-mail address other than the one indicated in the account, the requester must prove that he/she is the interested party.

Where the Controller has doubts as to the identity of the person making the request or exercises one of the rights listed below, the Controller may request further information to confirm the identity of the applicant. In the event of a request coming from an e-mail address other than the one indicated in the account, the applicant shall prove that he/she is the person concerned.

Requests and replies are free of charge unless they are repetitive. In the latter case, the Holder may charge for the out-of-pocket costs he incurs for the response (i.e. personnel costs, material costs, etc.).

In any case, the person concerned may turn to the Garante (https://www.garanteprivacy.it/home/diritti/come-agire-per-tutelare-i-nostri-dati-personali) or the competent judicial authority to exercise his or her rights.

15. HYPOTHESIS OF DATA BREACH

If one or more of the following events should occur with respect to users’ data: access, theft, loss, destruction, disclosure, unauthorised modification (so-called Data Breach), Castal srl, without prejudice to the urgent technical measures to be put in place to block (as far as possible) the event and to reduce its harmful effects, undertakes to:

• restore the service efficiently as soon as possible, recovering available data from the last useful backup made.
• inform users, either directly if circumstances permit or generically (by means of a notice on the Service’s home page or by means of a communication sent to all users, including those for whom there may have been no data events) of the type of event, the time at which it occurred, the measures taken (without going into detail so as not to facilitate any new attacks) to reduce the damage and to avoid new similar events, as well as the measures and expedients that the user should – on his/her part – put in place to reduce the likelihood of new events and limit the consequences of those that have already occurred.

The original of this INFORMATIVE text is deposited on the company server.