Privacy Notice pursuant to Articles 13 and 14 of Regulation (EU) 2016/679

Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (the “Regulation”), Lampa S.r.l., hereafter provides its customers, including potential ones, as well as third parties in general (e.g. proxies, legal representatives, etc.) who come into contact with the same on behalf of or on behalf of customers, including potential ones (the “Data Subjects”), with the information required by the regulation regarding the processing of their personal data (“Personal Data”).

1.-Data Controller and Personal Data Protection Manager

Lampa S.r.l. (c.f.-p.iva 00371630161), with registered office in Grumello del Monte, Via Brescia 33, in the person of its legal representative pro tempore, is the entity which processes the data of the Data Subjects and, for the purposes of the law, is considered the Data Controller of Personal Data. In this capacity it is responsible for guaranteeing the application of organisational and technical measures suitable for the protection of data in compliance with the provisions of the regulations in force.

Lampa S.r.l. has appointed a Data Protection Officer (DPO), who is responsible for ensuring compliance with the regulations for the protection of privacy and who can be contacted, for matters relating to the processing of Personal Data, at the following address: info@altofare.com

2.- Methods of Personal Data collection

The Personal Data subject to processing activities by the Data Controller may be acquired from the Data Subject, including through the remote communication techniques used by the Data Controller (e.g. websites, apps for smartphones and tablets, call centres, etc.);

3.- Categories of Personal Data processed

The Personal Data processed by the Data Controller include, by way of example:

1. browsing data (e.g. IP addresses or domain names of the computers used by users who connect to the site, the time of the request, the method used to submit the request to the server, the numerical code indicating the status of the response given by the server and other parameters relating to the operating system and browser used by the user, logs);
2. personal data (e.g. first name, surname, tax code, address, date and place of birth, nationality);
3. contact data (e.g. telephone numbers, landline and/or mobile, email address);
4. profiling and marketing data (e.g. interests and passions);
5. other data that fall into the above categories.

4.- Purposes and legal basis of the processing

Personal Data will, under the specified conditions, be processed for the purposes set out below:

• website registration and handling of contact requests and/or information material

The processing of the data subject’s personal data is carried out in order to carry out the activities preliminary and consequent to the request for registration to the website, if any, as well as for the management of requests for information and contact and/or the sending of informative material, and for the fulfilment of any other obligation arising.

The legal basis for such processing is the fulfilment of the services inherent in the request for registration, information and contact requests and/or the sending of informative material and the fulfilment of legal obligations.

The provision of data is optional, but any refusal on the part of the interested party to provide such data will make it impossible for the Data Controller to provide the service requested.

• performance of the contract

Personal data will be processed for the management of the contractual relationship (e.g. for the invoicing of fees, for the management of payments or complaints that you may forward to us) and for the provision of the requested services accessible via the website.

The legal basis for such processing is the fulfilment of services inherent to the contractual relationship and compliance with legal obligations.

The provision of data is optional, however, any refusal on the part of the data subject to provide such data will make it impossible for the Data Controller to carry out the requested service.

• fulfilment of legal obligations, defending a right in or out of court and fraud prevention

Personal Data shall be processed for the fulfilment of legal obligations, as well as to ascertain, exercise or defend a right of the Data Controller and/or defend against the claims of others, in or out of court. In particular, the Data Controller may process Personal Data for the fulfilment of accounting and tax obligations and for the fulfilment of judicial authority orders aimed at preventing and repressing crimes.

The legal basis of such processing is the pursuit of the legitimate interest of the Controller, taking into account the balancing of the rights of the latter and of the Data Subject.

• promotional activities on services/products similar to those purchased

The processing of the Data Subject’s personal data is carried out for the purpose of sending communications relating to promotions and offers of the Controller’s Services/Products that are identical and/or similar to those covered by the contract in force with the Data Subject, unless the latter has objected to such processing initially or on the occasion of subsequent communications.

The legal basis for such processing is the legitimate interest of the Controller to promote products or services to which the customer may reasonably be interested, taking into account the balancing of the rights of the latter and the Controller.

The Data Subject has the right to object at any time, on grounds relating to his or her personal situation, to the processing of personal data concerning him or her for the purpose in question.

• promotional activities on Services/Products offered by Lamba s.r.l.

The processing of the data subject’s personal data is carried out for the purpose of sending, subject to specific consent, notices of promotions and offers of the Controller’s Services/Products by means of traditional methods (e.g. ordinary mail, telephone calls with operator) and/or automated methods (e.g. e-mail, SMS, MMS, fax, pre-recorded telephone calls).

The legal basis for such processing is the consent given by the Data Subject prior to the processing itself, which may be revoked freely at any time, without prejudice to the lawfulness of the processing previously carried out.

If the data subject refuses to give consent, it will be impossible for him/her to use the relevant services, without this entailing detrimental consequences for the contractual relationship with the data controller.

• marketing purposes relating to products or services of partners of Lamba s.r.l.

The processing of the personal data of the interested party takes place for the sending, subject to specific consent, of communications of promotions and offers of Services/Products of Lampa S.r.l. business partners through traditional means (e.g. ordinary mail, telephone calls with operator) and/or automated means (e.g. e-mail, SMS, MMS, pre-recorded telephone calls).

The legal basis for such processing is the consent given by the interested party prior to the processing itself, which can be revoked freely at any time, without prejudice to the lawfulness of the processing previously carried out.

If the data subject refuses to give consent, it will be impossible for him/her to use the relevant services, without this entailing detrimental consequences for the contractual relationship with the data controller.

• profiling

The processing of the Personal Data, including location data, socio-demographic data acquired during the provision of electronic communication services and from public sources, of the Data Subject is carried out, subject to specific consent, for profiling purposes such as the analysis of transmitted data and purchased Services/Products in order to propose advertising messages and/or commercial proposals in line with the choices expressed by the users themselves. This activity will be carried out in aggregate and anonymised form by implementing models for analysing customer data using statistical algorithms, predictive models and aggregations only for the time strictly necessary for the purposes pursued, the type of goods marketed or services rendered.

In any event, Personal Data will not be subject to decisions based solely on automated processing, including profiling, which produce legal effects or affect the data subject in a similar significant way.

The legal basis for such processing is the consent given by the data subject prior to the processing itself, which may be revoked freely at any time, without prejudice to the lawfulness of the processing previously carried out.

If the data subject refuses to give consent, it will be impossible to use the relevant services, without this having any detrimental consequences for the contractual relationship with the data controller.

5.- Recipients of personal data

The personal data collected may be communicated to subjects who will act as autonomous Data Controllers or Data Processors, as the case may be, for the purposes set out above, in fulfilment of legal, regulatory and/or EU obligations or because they have a legitimate interest.

In particular, Personal Data may be made available to:

• subjects entrusted with the performance of activities connected with and instrumental to the processing (filing service companies, IT service companies, social media management service companies, marketing companies, insurance companies, banking institutions);
• business partners of Lampa S.r.l.;
• Public administrations, authorities and other entities in fulfilment of legal obligations;

Personal Data will not be disseminated (made available to unspecified persons).

6.- Transfer of data to third countries

The Personal Data of the Data Subject are stored in archives located in countries of the European Union. Where necessary for the pursuit of the stated purposes, the Data Subject’s Data may be transferred abroad, to countries/organisations outside the European Union that provide a level of protection of personal data deemed adequate by the European Commission in its decision, or on the basis of other appropriate safeguards, such as the Standard Contractual Clauses adopted by the European Commission or the consent of the Data Subject. The Data Subject has the right to obtain a copy of any Data transferred abroad, as well as a list of the countries/organisations to which the data have been transferred, by writing to info@altofare.com

7.- Personal data retention period

The Data shall be kept in a form that enables the identification of the Data Subject for a period of time not exceeding that necessary to achieve the purposes for which it was collected, taking into account the laws applicable to the activities and sectors in which the Data Controller operates. Once the terms thus established have elapsed, the Data will be deleted or transformed into anonymous form, unless their further storage is necessary to fulfil obligations (e.g. tax and accounting) that remain even after the termination of the contract (art. 2220 of the Italian Civil Code) or to comply with orders issued by Public Authorities and/or Supervisory Bodies.

The duration of cookies used on the site can be found in the relevant Cookie Policy:

In the event of litigation, the retention time indicated above may be extended up to 10 years from the settlement of the litigation.

8.- Treatment modalities

The processing will be carried out by authorised personnel who need to have knowledge of it in the course of their work, with the aid of electronic instruments, in accordance with principles of lawfulness and correctness, so as to protect the confidentiality and rights of the person concerned at all times in compliance with the provisions of the legislation in force.

Marketing-related profiling (analysis of consumption habits and choices) is carried out by means of an automated process for the purpose of studying and analysing behavioural profiles and aspects characterising the customer base in order to optimise promotional activities for products and services.

9.- Rights of the data subject

The Data Subject has the right to request from the Data Controller:

• confirmation as to whether or not your Personal Data are being processed and, if so, to obtain access to them (right of access);
• rectification of inaccurate Personal Data or supplementation of incomplete Personal Data (right of rectification);
• the deletion of Personal Data if one of the grounds provided for in the Privacy Regulation applies (right to be forgotten);
• the limitation of the processing of Personal Data when one of the cases provided for in the Privacy Regulation occurs (right of limitation);
• to receive in a structured, commonly used and machine-readable format the Personal Data to be provided to the Data Controller and to transmit such data to another Data Controller (right to portability);
• to object at any time in whole or in part to processing carried out in pursuit of a legitimate interest of the Controller and for marketing and profiling purposes (right to object);
• to revoke any consent to the processing of Personal Data, at any time, without prejudice to the lawfulness of the processing based on the consent given before revocation.

Consent given for the performance of marketing activities with automated contact methods (e.g. sms, mms, fax, phone, e-mail, web applications) also extends to traditional contact methods (paper mail or telephone call with operator). Similarly, the objection to marketing activities using automated contact methods also extends to traditional contact methods. This is without prejudice to your right to provide consent or to exercise your right of objection in relation to only one of the two ways of performing marketing activities.

To exercise his or her rights, the data subject may send a message to the mailbox info@altofare.com or a written communication to the holder at the registered office of Lampa S.r.l..

The Data Subject also has the right to lodge a complaint with the competent supervisory authority on the Italian territory (the Italian Data Protection Authority) or with the authority that performs its duties and exercises its powers in the Member State where the breach occurred, as provided for in Article 77 of the Regulation, as well as to take appropriate legal action pursuant to Articles 78 and 79 of the Regulation.

10.- Cookie