PRIVACY POLICY

Information on the processing of personal data pursuant to Art. 13 of regulation (EU) no. 2016/679 (hereinafter“GDPR”)

This page describes the Privacy Policy adopted by VR|46 RACING APPAREL S.r.l., with registered office in Pesaro at Via Rosselli n. 46, 61100, VAT no. 02495180412 (hereinafter, also VR46) and EASYREPLICA INTERNATIONAL SRL, with registered office in Via Toscana, 34 – 61122 Pesaro (PU), VAT no./Tax Code 02568220418 and registered with the Pesaro Companies Register, number PS – 192173 (hereinafter, also the “Partner” and, together with VR|46 RACING APPAREL S.r.l., the “Companies” or the “Joint Controllers”), in reference to the processing of personal data (the “Data”) relating to users (“Users”) who have provided them to the Companies through the registration of their Data on the e-commerce portal cesarecremonini.shop (the “Site”), given that the Companies have concluded a joint control agreement pursuant to Art. 26 of the GDPR, the essential content of which is available at the offices of the Joint Controllers.

This Site is reserved for individuals who are sixteen years of age or older. The Joint Controllers therefore do not collect personal Data relating to individuals under 16 years of age. Upon Users’ request, the Joint Controllers will promptly delete all personal Data inadvertently collected relating to individuals under 16 years of age.

1. Purposes of Processing and Related Legal Basis

The personal Data of Users will be lawfully processed by the Joint Controllers pursuant to Art. 6 of the GDPR for the following processing purposes:

1. To execute/fulfill specific contractual and pre-contractual obligations, allow navigation of the Site or execute the Site’s Terms of Use, which are accepted by the User during registration on the Site and/or during the use of services, and fulfill specific User requests (Article 6, para. 1, letter b) of the GDPR). The User’s Data collected include: first name, last name, tax code, age, residence/domicile address, gender, email address, as well as any personal information voluntarily published by the User. The Data will be used by the Joint Controllers for the sole purpose of verifying the User’s identity (also by validating the email address), thus preventing possible fraud or abuse, and contacting the User for service-related reasons only.
2. For administrative-accounting purposes, i.e., to carry out organizational, administrative, financial, and accounting activities (Article 6, para. 1, letter c) of the GDPR);
3. To comply with obligations provided for by law, by an authority, by a regulation, or by European legislation (Article 6, para. 1, letter c) of the GDPR).

The provision of personal Data for the processing purposes indicated above in letters a), b), and c) is optional but necessary, as failure to provide them will make it impossible for the User to browse the Site, register on the Site, and use the services. The personal Data that are necessary for the pursuit of the processing purposes described in this paragraph 1 are indicated with an asterisk within the registration form on the Site.

2. Additional Processing Purposes: Marketing (Sending Advertising Material, Direct Sales, and Commercial Communication)

With the free and optional consent of the User, certain personal Data (namely, first name, last name, email address, residence address) may be processed for the purpose of carrying out promotional activities (so-called “marketing”) and sending informative and promotional communications — by the Joint Controllers — about products and services via postal mail, email, telephone (landline and/or mobile) and/or SMS and/or MMS.

In case of lack of consent, the possibility to register on the Site will not be prejudiced in any way. In case of consent, the User may withdraw it at any time, by requesting it using the methods indicated in paragraph 8 below.

The User may also easily object to further promotional communications via email by clicking on the appropriate link for withdrawing consent, which is present in each promotional email. Once consent is withdrawn, an email will be sent to the User to confirm the successful withdrawal of consent. If the User wishes to withdraw their consent to receive promotional communications via telephone, while continuing to receive promotional communications via email, or vice versa, please send a request using the methods indicated in paragraph 8 below. Please note that, following the exercise of the right to object to the sending of promotional communications via email, it is possible that, for technical and operational reasons (e.g., contact list formation already completed shortly before the Partner received the objection request), the User may continue to receive some additional promotional messages. If the User continues to receive promotional messages after 24 hours have passed since the exercise of the right to object, please report the problem to the Partner using the contacts indicated in paragraph 8 below.

3. Additional Processing Purposes: Newsletter

With the free and optional consent of the User, certain personal Data of the User (namely, first name, last name, address, email address) may also be processed by the Joint Controllers for the purpose of sending the newsletter. Therefore, the User will receive a periodic newsletter containing information regarding news and promotions on the Site and/or initiatives of the Joint Controllers. In case of lack of consent, the possibility to register on the Site will not be prejudiced in any way. In case of consent, the User may withdraw it at any time, by requesting it from the Partner using the methods indicated in paragraph 8 below. The User may also easily object to further promotional communications by clicking on the appropriate link for withdrawing consent, which is present in each email containing the newsletter. Once consent is withdrawn, an email will be sent to the User to confirm the successful cancellation.

4. Additional Processing Purposes: Profiling

With the free and optional consent of the User, the User’s personal Data (i.e., personal and contact details, and information relating to services in which the User has expressed interest) may also be processed by the Joint Controllers for profiling purposes, meaning to reconstruct the User’s tastes and consumption habits, identifying their consumer profile, in order to send the User commercial offers consistent with the identified profile. In case of lack of consent, the possibility to register on the Site will not be prejudiced in any way. In case of consent, the User may withdraw it at any time, by requesting it from the Partner using the methods indicated in paragraph 8 below.

5. Processing Methods and Data Retention Periods

The Joint Controllers will process Users’ personal Data using manual and IT tools, with logic strictly related to the purposes themselves, and in any case, in a manner that guarantees the security and confidentiality of the Data. Users’ personal Data will be retained for the time strictly necessary to fulfill the primary purposes illustrated in the preceding paragraph 1, or in any case as necessary for the civil law protection of the interests of both Users and the Joint Controllers. In the cases referred to in paragraphs 2, 3, and 4 above, Users’ personal Data will be retained for the time strictly necessary to fulfill the purposes illustrated therein and, in any case, for no more than, respectively, twenty-four (24) months for marketing activities and twelve (12) months for profiling.

6. Scope of Data Communication and Dissemination

The employees and/or collaborators of the Joint Controllers assigned to manage the Site may become aware of Users’ personal Data. These individuals, who have been instructed accordingly by the Joint Controllers, will process User Data exclusively for the purposes indicated in this policy and in compliance with the provisions of the Applicable Law.

Third parties who may process personal Data on behalf of the Joint Controllers as “External Data Processors” pursuant to Art. 28 of the GDPR, such as, for example, IT and logistics service providers functional to the operation of the Site, outsourcing or cloud computing service providers, may also become aware of Users’ personal Data.

Your Data may also be communicated by the Joint Controllers, to the extent necessary and essential to fulfill contractual obligations, to independent data controllers, such as payment service providers and logistics service providers necessary for the delivery of goods sold through the Site, consultants, and professionals.

7. Social Buttons and Widgets

The Site also features social buttons/widgets. These are, in particular, social network icons, such as Facebook, Twitter, Pinterest, Google+, YouTube, and Instagram, which allow Users to reach the respective social networks by “clicking” on the icon. With the support of these tools, the User can, for example, share content or recommend products from the Site on social networks. Some content shared on social networks may also be shared on the dedicated page of the website. Following a click on social buttons/widgets, the social network may collect Data relating to the User’s visit to the Site. As anticipated in the preamble, this privacy policy does not concern the processing of User Data by the social network, for which the User must refer exclusively to the privacy policy provided by the social network. Except in cases where the User spontaneously shares their Data with the chosen social networks by clicking on the social button/widgets, the Joint Controllers do not disseminate or share any personal User Data with social networks.

8. Rights of the Data Subjects

We inform you that, at any time, regarding your Data, you may exercise the rights provided within the limits and conditions set forth in Articles 7 and 15-22 of the GDPR.

An appropriate response will be provided to such a request without delay within one month of its receipt.

To exercise these rights, described below, please contact the Partner at the following addresses:

• By sending a registered letter with return receipt to the Partner’s registered office at Via Toscana, 34 – 61122 Pesaro (PU);
• By sending an email to the Partner’s Data Protection Officer (DPO) at the email address: support@cesarecremonini.shop.

Furthermore, you have the right to:

• Obtain confirmation as to whether or not personal Data concerning you is being processed;
• If processing is underway, obtain access to the personal Data and information relating to the processing, as well as request a copy of the personal Data;
• Obtain the rectification of inaccurate personal Data and the integration of incomplete personal Data;
• Obtain, if one of the conditions provided for by Art. 17 of the GDPR exists, the erasure of personal Data concerning you;
• Obtain, in the cases provided for by Art. 18 of the GDPR, the restriction of processing;
• Receive the personal Data concerning you in a structured, commonly used, and machine-readable format and request their transmission to another controller, if technically feasible.

Right to Object

Each data subject has the right to object at any time to the processing of their Data carried out for the pursuit of a legitimate interest. In case of objection, your Data will no longer be processed, unless there are legitimate reasons to proceed with the processing that override the interests, rights, and freedoms of the data subject or for the establishment, exercise, or defense of a legal claim.

Right to Object and to Withdraw Consent in relation to processing carried out for marketing and profiling purposes

With reference to the processing of Data for marketing and profiling purposes, each data subject may withdraw any consent given or object to the processing at any time, by writing to the addresses indicated above.

The withdrawal of your consent will not affect the lawfulness of processing based on consent given before its withdrawal.

The objection to processing exercised through these methods also extends to the sending of commercial communications via postal service or telephone calls with an operator, without prejudice to the possibility of exercising this right in part, for example by objecting only to processing carried out using automated communication systems.

Right to Lodge a Complaint with the Privacy Garante

Finally, pursuant to Article 77 of the GDPR, we remind you that you have the right to lodge a complaint with the Privacy Garante, in case you believe that your rights under the GDPR have been violated, according to the procedures indicated on the Privacy Garante’s website accessible at www.garanteprivacy.it .

9. Joint Controllers, Processors, and Data Protection Officer

The Joint Controllers of the data are:

• VR|46 RACING APPAREL S.r.l., with registered office in Pesaro at Via Rosselli n. 46, 61100, VAT no. 02495180412;
• EASYREPLICA INTERNATIONAL SRL, with registered office in Via Toscana, 34 – 61122 Pesaro (PU), VAT no./Tax Code 02568220418 and registered with the Pesaro Companies Register number PS – 192173.

The relationship between the Joint Controllers is governed by a written agreement, filed at their respective offices.

The complete list of the respective Data Processors is available at the Joint Controllers’ offices and can be requested at the email address: info@easyreplica.com.

Furthermore, the Data Protection Officer of EASYREPLICA INTERNATIONAL SRL can be contacted at the email address:info@easyreplica.com.

This policy will be subject to updates. The Data Controllers therefore invite Users who wish to know the methods of processing personal Data collected by the Companies to periodically visit this page.