Information notice pursuant to and for the purposes of Article 13 of Regulation (EU) 2016/679 (GDPR) and Article 130 of the Privacy Code

WHY THIS INFORMATION
1. WHO IS THE DATA CONTROLLER? HOW CAN THEY BE CONTACTED?
The data controller is AAA Trading Company S.r.l., with its registered office at Via Pietro Micca 20, 10122 Turin, in the person of its current legal representative, who may be contacted for any enquiries by email at aaatrading@legalmail.it

HAS A DATA PROTECTION OFFICER BEEN APPOINTED? WHAT ARE THEIR CONTACT DETAILS?
AAA Trading Company S.r.l. has appointed its Data Protection Officer (DPO) in accordance with Articles 37, 38 and 39 of the GDPR. The DPO can be contacted at the Data Controller’s registered office as stated above and by email at aaatrading@legalmail.it

2. TYPES OF DATA SUBJECT TO PROCESSING
Personal data: any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

3. PURPOSES OF PROCESSING, LEGAL BASIS, RETENTION PERIOD AND NATURE OF DATA PROVISION<br/><br/>PURPOSES OF PROCESSING A

A) Contacts: sending contact requests and information.
LEGAL BASIS: the processing is necessary for the performance of a contract to which the data subject is a party or for the implementation of pre-contractual measures taken at the data subject’s request; (C44)
Article 6(1)(b) of the GDPR.
DATA RETENTION PERIOD: maximum 12 months.
NATURE OF DATA PROVISION: provision of data is necessary.
Failure to provide the necessary data will make it impossible to be contacted or to receive information.

PURPOSE OF PROCESSING B
B) Direct marketing, for the sending of advertising or direct sales material, or for the purposes of market research, satisfaction surveys/reviews, commercial and promotional communications, and newsletters, via automated means (email, SMS, instant messaging systems such as WhatsApp). The Data Controller uses reporting systems to analyse and, where appropriate, improve the results of automated communications. Thanks to these reports, the Data Controller will be able to ascertain, for example: the number of readers, opens, unique ‘clickers’ and ‘clicks’; the devices and operating systems used to view the communication; details of individual users’ activity; and details of emails sent, delivered and undelivered, as well as those forwarded. All this data is used for the purpose of analysing, and where possible improving, the results of the communications.
LEGAL BASIS: The processing is based on consent to the processing of personal data (C42, C43)
Article 6(1)(a) of the GDPR.
DATA RETENTION PERIOD: 24 months from the date on which consent is given or (if earlier) until consent is withdrawn (or the opt-out is exercised).
NATURE OF DATA PROVISION: the provision of data is optional. Failure to provide the necessary data will mean that you will not be able to receive direct marketing communications and (where your date of birth is also provided) direct marketing communications containing dedicated discount codes.

PURPOSES OF DATA PROCESSING C
C) Fulfilment of contractual obligations and administrative, accounting and legal purposes relating to the establishment, performance and termination of the contractual relationship.
LEGAL BASIS: data processing is necessary for the performance of a contract (C44)
Article 6(1)(b) of the GDPR.
DATA RETENTION PERIOD: 10 years. Article 2220 of the Civil Code, subject to any contractual or non-contractual issues that may arise and subject to any other legal obligations.
NATURE OF THE PROVISION OF DATA: the provision of personal data is necessary for contractual purposes.
Failure to provide the necessary personal data will make it impossible to enter into a contractual relationship with you.

PURPOSE OF THE PROCESSING D
D) DIRECT MARKETING, AUTOMATED ‘SOFT-SPAM’ E-MAILS: the data controller shall use, for the purposes of direct marketing of its own products or services, the email addresses provided by the data subject in the context of the sale of a product or service, without requiring the data subject’s consent, for promotional and commercial communications and newsletters concerning services similar to those sold, provided that the data subject, having been duly informed, does not object to such use, either initially or in response to subsequent communications. At the time of collection and whenever a communication is sent for the purposes referred to in this paragraph, the data subject shall be informed of the possibility of objecting to the processing at any time, easily and free of charge.
In order to analyse and, where appropriate, improve the results of its communications, the Data Controller uses systems for sending newsletters and promotional communications that generate reports. Thanks to these reports, the Data Controller will be able to ascertain, for example: the number of readers, opens, unique ‘clickers’ and clicks; the devices and operating systems used to view the communication; details of individual users’ activity; details of emails sent, delivered and undelivered, and those forwarded. All this data is used for the purpose of analysing, and where appropriate improving, the results of the communications.
LEGAL BASIS: the processing is necessary for the purposes of the legitimate interests pursued by the data controller or by a third party, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data (C47–C50) Article 6(1)(f) of the GDPR and Article 130(4) of Legislative Decree 196/2003.
DATA RETENTION PERIOD: until you object (opt-out).
NATURE OF DATA PROVISION: the provision of data is optional. Failure to provide the necessary data will make it impossible to receive direct marketing communications via email (soft-spam).

PURPOSE OF THE PROCESSING AND
E) Performance of the contract relating to membership of the loyalty programme
LEGAL BASIS: the processing is necessary for the performance of a contract to which the data subject is a party (Article 6(1)(b) and (c) of the GDPR).
DATA RETENTION PERIOD: For the entire duration of the contract and, following its termination, for a maximum period of 10 years from the date of collection.
NATURE OF DATA PROVISION: The provision of data is optional. Failure to provide such data will prevent you from joining the loyalty programme in accordance with the terms set out in the relevant regulations.

PURPOSE OF THE PROCESSING F
F) MANAGEMENT OF YOUR REQUESTS and requests from other data subjects, in accordance with Article 15 et seq. of the GDPR (data subject rights).
LEGAL BASIS: the processing is necessary for compliance with a legal obligation to which the data controller is subject (C45) Article 6(1)(c) of the GDPR.
DATA RETENTION PERIOD: 5 years from the closure of the request, except in the event of litigation.
NATURE OF DATA PROVISION: The provision of personal data is mandatory, as it is essential for the fulfilment of legal obligations.

PURPOSE OF PROCESSING G
G) Prevention and management of disputes and other legal matters, and for the purposes of defence in the event of legal proceedings
LEGAL BASIS: The processing is necessary for the purposes of the legitimate interests pursued by the data controller or by a third party, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data (C47–C50)
Art. 6(1)(f) GDPR
DATA RETENTION PERIOD: 10 years, unless an objection is raised and subject to the time required for defence in legal proceedings
NATURE OF DATA PROVISION: The provision of data is necessary.
Any refusal must be weighed against the data controller’s legitimate interest as set out in the purposes of this point.

PURPOSE OF PROCESSING H
H) CUSTOMER AREA: to access your account, register or manage your profile.
LEGAL BASIS: the processing is necessary for the performance of a contract to which the data subject is a party or for the implementation of pre-contractual measures taken at the data subject’s request (C44), Article 6(1)(b) of the GDPR.
DATA RETENTION PERIOD: until the contract ends or until the account is deleted, subject in all cases to the technical time required to deactivate the login credentials.
NATURE OF DATA PROVISION: provision of data is necessary. Failure to provide the necessary data will make it impossible to access your account.

4. TO WHOM WILL PERSONAL DATA BE DISCLOSED? RECIPIENTS OF THE DATA
Personal data will be disclosed, including in accordance with the purposes set out for specific areas, to parties who will process the data as independent data controllers or data processors (Article 28 of the GDPR) and processed by natural persons (Article 29 of the GDPR) acting under the authority of the Data Controller and Data Processors on the basis of specific instructions provided regarding the purposes and methods of processing, for specific purposes depending on the relevant area. The data will be disclosed to recipients falling within the following categories: entities providing services for the website and communication networks, including email, hosting and website management; entities based in Italy with which the Data Controller has entered into agreements (e.g. consultants, courier and transport companies, etc.); social media channels; entities responsible for managing direct marketing activities; competent authorities for the fulfilment of legal obligations and/or provisions issued by public bodies, upon request.

5. IS DATA TRANSFERRED TO A COUNTRY OUTSIDE THE EEA?
Data is processed and stored in Europe. Please note that should personal data be transferred to countries outside the European Economic Area, this will be carried out in accordance with the measures laid down by the applicable legislation, ensuring an adequate level of protection for data subjects. For information regarding the safeguards relating to data transfers outside the EEA, please write to aaatrading@legalmail.it.

6. IS THERE AN AUTOMATED PROCESS?
Personal data will be processed manually, electronically and automatically. Please note that no fully automated decision-making processes are carried out.

7. RIGHTS OF DATA SUBJECTS
You may exercise your rights as set out in Articles 15 et seq. of the GDPR by contacting the Data Protection Officer (DPO) at aaatrading@legalmail.it or by contacting the Data Controller at the email address aaatrading@legalmail.it. You have the right, at any time, to request access to your personal data (Article 15), rectification (Article 16), erasure (Article 17) and restriction of processing (Article 18). The Data Controller shall notify (Article 19) each recipient to whom personal data have been disclosed of any rectification, erasure or restriction of processing carried out. The Data Controller shall inform the data subject of such recipients if the data subject so requests. In the cases provided for, you have the right to data portability (Article 20) and, in such cases, your data will be provided to you in a structured, commonly used and machine-readable format. You have the right to object (Article 21), at any time, to the processing of data based on legitimate interests, and where the legal basis is consent, you have the right to withdraw the consent you have given without affecting the lawfulness of processing based on consent prior to its withdrawal.
If you no longer wish to receive automated direct marketing communications (emails, SMS-type messages, instant messaging), please send an email to aaatrading@legalmail.it with the subject line “unsubscribe from automated communications” or use our automatic unsubscribe systems, which are available for emails only (opt-out).
Should you consider that the processing of personal data carried out by the Data Controller is in breach of the provisions of Regulation (EU) 2016/679, the data subject has the right to lodge a complaint with the supervisory authority, in particular in the Member State where they habitually reside or work, or in the place where the alleged infringement of the Regulation occurred (Data Protection Authority https://www.garanteprivacy.it/), or to bring the matter before the appropriate courts.

8. CHANGES TO THIS PRIVACY POLICY
The Data Controller reserves the right to amend, update, add to or remove parts of this privacy policy. To make it easier to check and amend the text, the privacy policy will include the date of the last update.

Date updated: 11 November 2024.
In accordance with Articles 6 and 13 of EU Regulation 2016/679 – the GDPR – I have read the privacy notice regarding the processing of personal data by AAA Trading Company S.r.l.