Articles 13 and 14 of Regulation (EU) 2016/679 (hereinafter also “GDPR”)

Why This Notice

Punto Finestre S.p.A. (hereinafter also the “Company” or the “Data Controller”) is committed to respecting and protecting your privacy and wishes you to feel secure both when simply browsing the website and when you decide to register by providing your personal data in order to use the services made available to its Users and/or Customers.
In this page, the Company aims to provide information regarding the processing of personal data of users who visit or browse the website accessible electronically at the following address: www.puntopersiane.com (the “Website”).
This notice is provided solely for the Company’s website and not for any other websites that may be accessed by the user via links (for which reference should be made to the respective privacy policies).
The reproduction or use of pages, materials, and information contained within the Website, by any means and on any medium, is not permitted without the prior written consent of the Company.
Copying and/or printing is allowed exclusively for personal and non-commercial use (for requests or clarifications, please contact the Company using the contact details provided below).
Any other use of the content, services, and information available on this website is not permitted.

With regard to the content and information provided, the Company will endeavour to keep the Website content reasonably updated and reviewed, without providing any warranty as to the adequacy, accuracy, or completeness of the information provided, and expressly disclaims any liability for any errors or omissions in the information published on the Website.

Source – Browsing Data

The Company informs you that the personal data you provide and those collected in connection with information requests and/or contact requests, website registration, and the use of services via smartphone or any other device used to access the Internet, as well as the data necessary to provide such services, including browsing data and data used for any purchase of products and services offered by the Company, as well as so-called “browsing data” of the Website by Users, will be processed in compliance with applicable legislation.
The IT systems and software procedures used for the operation of this website acquire, during their normal functioning, certain personal data whose transmission is implicit in the use of Internet communication protocols.
This information is not collected in order to be associated with identified data subjects, but by its very nature could, through processing and association with data held by third parties, allow users to be identified.
This category of data includes IP addresses or domain names of the computers used by users connecting to the Website, URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to submit the request to the web server, the size of the file obtained in response, the numerical code indicating the status of the server response (successful, error, etc.), and other parameters relating to the user’s operating system and IT environment.
These data are used solely for the purpose of obtaining anonymous statistical information on website usage and to ensure its correct functioning.
It is also noted that such data may be used to establish liability in the event of possible cybercrimes against the Company’s website or other sites connected or linked to it. Except for this possibility, browsing data is currently not stored for more than a few days.

Source – Data Provided by the User

The Company collects, stores, and processes your personal data for the purpose of providing the products and services offered on the Website, or to comply with legal obligations. With regard to certain specific Services, Products, Promotions, etc., the Company may also process your data for marketing purposes. In such cases, you will be asked to provide specific, separate, optional consent, which may be withdrawn at any time using the methods and contact details indicated below.

The optional, explicit, and voluntary sending of emails to the addresses indicated in the relevant section of the Website, as well as the completion of questionnaires (e.g., forms), communication via chat, push notifications through the APP, social networks, call centers, etc., entails the subsequent collection of certain personal data, including data collected through the use of Apps and related services, which are necessary to respond to your requests.
We also inform you that, when using a mobile connection to access digital content and services provided directly by the Company or by our Partners, it may be necessary to transfer your personal data to such third parties.
Please note that you may access the Website or connect to areas where you are allowed to publish information using blogs or message boards, communicate with others, for example via the Company’s pages on Facebook®, LinkedIn®, YouTube®, and other social networking sites, review products and offers, and post comments or content.
Before interacting with such areas, we invite you to carefully read the Terms of Use, bearing in mind that, in some circumstances, the information you publish may be viewed by anyone with Internet access, and all information included in your posts may be read, collected, and used by third parties.

Purpose of Processing and Legal Basis

The data are processed for the following purposes:

1. strictly related and necessary for registration on the website www.puntopersiane.com, for the use of services and/or Apps developed or made available by the Company, for accessing related informational services, for managing contact or information requests, and for the purchase of products and services offered through the Company’s website;
2. for ancillary activities related to managing User/Customer requests and providing responses, which may include the sending of promotional materials; for the completion of purchase orders for products and services offered, including aspects related to credit card payments, shipment management, the possible exercise of the right of withdrawal provided for distance purchases, and updates on the availability of products and services that are temporarily unavailable;
3. related to the fulfilment of obligations under EU and national legislation, the protection of public order, and the detection and prevention of criminal offences;
4. direct marketing activities, i.e., the sending of advertising materials, direct sales, market research, or commercial communications relating to products and/or services offered by the Company. Such activities may also concern products and services of companies within the Company’s Group and may be carried out through the sending of advertising, informational, or promotional materials and/or invitations to participate in initiatives, events, and offers aimed at rewarding users/customers, using both “traditional” methods (such as postal mail and/or operator-assisted calls) and “automated” contact systems (such as SMS and/or MMS, telephone calls without operator assistance, emails, fax, interactive applications), pursuant to Article 130(1) and (2) of Legislative Decree 196/03, as amended;

The provision of data for the purposes referred to in points 1), 2), and 3), which are related to a pre-contractual and/or contractual phase, or necessary to respond to a user’s request or required by applicable legal provisions, is mandatory. In the absence of such data, it will not be possible to provide the requested information or access the relevant services.
With regard to point 4) of this Notice, the user/customer’s consent to the processing of personal data is voluntary and optional, and may be withdrawn at any time without affecting the usability of the products and services, except for the Company’s inability to keep users/customers informed about new initiatives, specific promotions, or benefits that may be available.

The Company may send commercial communications relating to products and/or services similar to those already provided, pursuant to Directive 2002/58/EC, using the email or postal contact details you have provided in such circumstances. You may object to such communications at any time using the methods and contact details indicated below.

Processing Methods, Logic, Retention Periods and Security Measures

The processing is carried out also with the aid of electronic or otherwise automated means and is performed by the Company and/or by third parties appointed by the Company to store, manage, and transmit such data.
Personal data will be processed using organisational and processing logics applied to your personal information, including data logs generated through access to and use of web-based services, products, and services, in line with the purposes indicated above and, in any case, in such a way as to ensure the security and confidentiality of the data.
Personal data will be retained for the period required by the applicable legislation in force from time to time.

With regard to data security, in the sections of the Website designed for specific services where users are required to provide personal data, the information is encrypted using a security technology called Secure Sockets Layer (SSL). SSL technology encodes the information before it is exchanged over the Internet between the user’s device and the Company’s central systems, making it unintelligible to unauthorised parties and thus ensuring the confidentiality of the transmitted information.
Furthermore, transactions carried out using electronic payment instruments are processed directly through the Payment Service Provider (PSP) platform, and the Company retains only the minimum set of information necessary to manage any potential disputes.
In relation to data protection matters, pursuant to Article 33 of the GDPR, users/customers are invited to report to the Company any circumstances or events that may give rise to a potential “personal data breach” in order to allow prompt assessment and the implementation of any necessary measures to address such incidents, by sending an email to info@puntopersiane.it or contacting Customer Service.
The measures adopted by the Company do not exempt the Customer from taking the necessary care when using passwords/PINs of adequate complexity, which should be changed periodically—especially if there is a suspicion that they may have been compromised or accessed by third parties—and kept securely and inaccessible to others in order to prevent improper or unauthorised use.

Cookies

A cookie is a short string of text that is sent to your browser and, if necessary, saved on your computer (alternatively on your smartphone/tablet or any other device used to access the Internet). This generally occurs every time you visit a website. The Company uses cookies for various purposes, in order to offer you a fast and secure digital experience, for example, by allowing you to keep your connection to the protected area active while browsing through the pages of the website.

The cookies stored on your device cannot be used to retrieve any data from your hard disk, transmit computer viruses or identify and use your email address. Each cookie is unique in relation to the browser and device you use to access the Website or use the Company’s App. In general, the purpose of cookies is to improve the functioning of the website and the user’s experience when using it, although cookies can be used to send advertising messages (as specified below).

For detailed information on Cookies, please read the dedicated section

Areas of communication and data transfer.

In order to pursue the purposes indicated above, the Company may disclose and have the personal data of users/customers processed, in Italy and abroad, by third parties with whom we have relationships, where these third parties provide services at our request. We will only provide these third parties with the information necessary to perform the requested services, taking all measures to protect your personal data. The data may be transferred outside the European Economic Area if this is necessary for the management of your contractual relationship. In this case, the recipients of the data will be subject to protection and security obligations equivalent to those guaranteed by the Data Controller. In the case of use of services offered directly by Partners, we will provide only the data strictly necessary for their performance. In any case, only the data necessary for the pursuit of the intended purposes will be disclosed and, where required, the guarantees applicable to data transfers to third countries will be applied. We may also disclose personal data to our commercial service providers, for marketing purposes, who are appointed as external data processors for this purpose. Furthermore, personal data may be disclosed to the relevant public bodies and authorities to comply with legal obligations or to ascertain liability in the event of cybercrimes against the website. It may also be disclosed to, or stored by, third parties (acting as data processors or, in the case of electronic communications service providers, as independent data controllers) who provide IT and telematic services (e.g., hosting, website management and development services) and which the Company uses to perform tasks and activities, including technical and organisational ones, essential for the website’s operation. The entities belonging to the above categories operate as separate Data Controllers or as Data Processors appointed for this purpose by the Company.

Personal data may also be disclosed to employees/consultants of the Company who are specifically trained and appointed as Data Processors.

The categories of recipients to whom the data may be disclosed are available by contacting the Company at the addresses indicated below.

Rights of data subjects

You may at any time exercise the rights granted to you by law, including the right:

1. to access your personal data, obtaining evidence of the purposes pursued by the Data Controller, the categories of data involved, the recipients to whom the data may be disclosed, the applicable retention period, and the existence of automated decision-making processes;
2. to obtain promptly the rectification of inaccurate personal data concerning you;
3. to obtain, in the cases provided for, the erasure of your data;
4. to obtain the restriction of processing or to object to processing, where possible;
5. to request the portability of the data you have provided to the Company, i.e. to receive it in a structured, commonly used and machine-readable format, including for the purpose of transmitting such data to another data controller, within the limits and with the restrictions provided for in Article 20 of the GDPR;

In addition, you may lodge a complaint with the Data Protection Authority pursuant to Article 77 of the GDPR.

For the purposes referred to in point 4), the Customer may always withdraw consent and exercise the right to object to direct marketing (in both “traditional” and “automated” forms). In the absence of any indication to the contrary, the objection shall refer to both traditional and automated communications.

Data Controller

The Data Controller, pursuant to Article 4 of the GDPR, is Punto Finestre S.p.A., Via Monte Napoleone, 8 – 20121 Milan (MI) VAT No.: 03598090177 – Tax Code: 03598090177

The above rights may be exercised at the request of the Data Subject in the manner disclosed by Customer Service or on the Company’s website or by using the following contact details: Fabrizio Rolfi (info@puntopersiane.it).

The use of the Website, including those intended for tablets and/or smartphones, by the Customer and/or the User implies full knowledge and acceptance of the content and any indications included in this version of the privacy notice published by the Company at the time the site is accessed. The Company informs you that this policy may be modified without prior notice and therefore recommends that you read it periodically.