1. DATA CONTROLLER

Rizoma S.r.l. (hereinafter “Rizoma” or the “Data Controller“)
Registered office: Ferno (VA), via Quarto 30/32/34
Italian Tax Code and VAT No. 02595720125
Email address: info@rizoma.com
Website: www.rizoma.com ( the “Site”)
Indirizzo e-mail: info@rizoma.com
Sito web: www.rizoma.com (il “Sito”)

2. PERSONAL DATA PROCESSED

• Browsing data 
• Personal data (name, surname, residence address);
• Contact details (email address and telephone number); 
• Data relating to purchases made on the Site;
• Data relating to the products selected in the “Wish List”
• Billing details (e.g. VAT number, SDI code, etc.);

(jointly also referred to as the “Data“).

3. COLLECTION OF PERSONAL DATA

Browsing data

The computer systems and software procedures used to operate this Site acquire, during their normal operation, some personal data, including the IP addresses or domain names of the computers used by users who connect to the Rizoma Site, the URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used in submitting the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters related to the user’s operating system and computer environment. 

These data, collected by means of cookies and metadata described in the Cookie Policy of the Rizoma Site, to which reference is made and used for the sole purpose of obtaining anonymous statistical information on the use of the Site and to check its correct functioning, are deleted immediately after processing. The data could be used to ascertain responsibility in the event of hypothetical computer crimes against the site.

Contact details, personal details, relating to purchases, selected for the wish lists and billing

These data are collected by the Data Controller following the addition on the Site by the data subject at the time of registration of an account and/or at the time of purchase on the Site and will be processed for the purposes and in the manner described in this policy.

Personal and contact data may also be voluntarily communicated by the user during a conversation activated by the user using the “Chat” icon. It should be noted that the Chat is managed independently by the company Guuru (terms, conditions and privacy policy are available on the same communication screen). The content of the conversation and any personal data communicated by users will therefore be communicated by Guuru to Rizoma and will be processed by the latter as the autonomous owner of the same, in order to follow up on any specific requests from the user (e.g. requests for contacts for information on products or purchases), in the manner and for the purposes indicated in this policy.

4. PURPOSE AND LEGAL BASIS OF THE PROCESSING

In some sections of the Site, in relation to specific services, some of the Data listed above are requested, which will be processed by the Data Controller for the purposes and legal bases indicated below.

• For the execution of pre-contractual measures and/or a contract to which you are a party:
  • for the purpose of registering a user on the website www.rizoma.com (“Account”);
  • for the management and technical administration of the website;
  • to proceed with the purchase of Rizoma products;
  • to be able to use the services reserved for holders of a personal Account on the Site, such as the selection of products to be included in the wishlist, the display of previous purchases, use of customer service also through the “livechat” channel on the Site, etc.;
  • to correctly receive and process requests for information and contact received.
  • For the management of the shipment and delivery of the products ordered;

• Based on a legitimate interest of the Data Controller (soft spam pursuant to art. 130 paragraph 4 of Legislative Decree 196/2003 as updated by Legislative Decree 101/2018 – Code regarding the protection of personal data), for the promotion by e-mail of goods or services similar to those of the sale, without prejudice to the possibility of objecting at any time.

• Furthermore, subject to your prior, optional and revocable consentat any time, the personal data collected may be processed for further purposes, and in particular for:
  • Marketing: to send you communications of initiatives, commercial offers also on digital media, questionnaires and market research of the Data Controller through digital channels (for example by email);

In any case, your personal data may be processed, where necessary, also for the following purposes:

• For the need to fulfil legal obligations, and in particular to fulfil obligations provided for by regulations and applicable national and supranational legislation (tax, administrative obligations, etc.);
• Based on a legitimate interest (judicial protection), to ascertain, exercise or defend the rights of the Data Controller in court and/or out of court.

5. RETENTION PERIOD

• For the entire duration of the contract and, after termination, for the ordinary limitation period of 10 years, for processing based on the execution of pre-contractual measures and/or a contract to which the data subject is a party;
• Until the exercise of its right to opt-out for the promotional activity by e-mail of services similar to those of the sale, based on the legitimate interest of the Data Controller (soft spam);
• The marketing consent granted by customers who have made a purchase of products on the Site will be kept for a period of 4 years, corresponding to the average life cycle of the Rizoma products or vehicles on which they will be installed and, therefore, to the average period of interest expected for new Rizoma products. In any case, the possibility remains for the data subject to renew this consent within the term of this period and, in any case, his/her right to revoke the consent at any time.
• The data of users who have registered their Account without proceeding with the purchase with the same credentials will be kept until the cancellation of the account; the marketing consent granted by these users will be kept for a period of 2 years, without prejudice to the possibility for the data subject to renew the consent within the term of this period and, in any case, his right to revoke the consent at any time.
• For the duration provided for by law (10 years for administrative-accounting obligations) for the processing of compliance with legal obligations;
• In the case of judicial litigation, for the entire duration of the same, until the expiry of the terms of applicability of the appeal actions, for the treatment of judicial protection of the Data Controller on the basis of its legitimate interest. 
• For a period of 7 days for the processing of contact data voluntarily communicated by the user for requests for information through the chat available on the Site.

The personal data in question, once the storage periods indicated above have expired, will be destroyed, deleted or made anonymous in accordance with the technical deletion and backup procedures and with the accountability needs of the Data Controller.

6. OBLIGATION TO PROVIDE DATA

The provision of the Data processed for the purposes of the execution of pre-contractual measures and/or of a contract and the fulfilment of legal obligations is necessary for the stipulation of the various contractual relationships, the execution of the orders and services requested and the fulfilment of legal obligations.

Therefore, any refusal by the data subject will make it impossible for the Data Controller to provide the requested service.

In relation to any optional processing, the provision of data is completely optional and the data subject may express his/her right to opt-out at any time. Optional processing means the processing of data not indicated on the Site as mandatory with the affixing of an asterisk (*), of data voluntarily communicated through the Chat and processing for marketing purposes based on the free and informed consent of the data subject.

With regard to browsing data, see Cookie Policy which can be accessed from the link in the sidebar at the bottom of the page.

7. DATA RECIPIENTS

The Data may be known and processed by employees of the company departments responsible for the pursuit of the purposes indicated above, who have been expressly authorised to process them and who have received adequate operating instructions.

Furthermore, the Data may be processed by external subjects operating as independent data controllers such as, by way of example, supervisory and control bodies, Public Authorities that expressly request it for administrative or institutional purposes and, in general, all subjects entitled by current national and European legislation to request such data.

The Data may also be processed, on behalf of the Company, by external parties qualifying as data processors (pursuant to art. 28 of the GDPR). These subjects, by way of example, can be:

• companies that carry out the management and/or maintenance service of the Company’s website;
• companies that provide e-commerce platform management services; 
• companies that offer support in carrying out market studies; 
• companies that offer emailing and promotional material services; 
• companies that offer customer management services (CRM);
• companies that offer services for the management of the information system and telecommunications networks, including email;
• companies that offer services for sending documentation and/or products (post offices, freight forwarders, couriers, etc.);
• banking and/or payment institutions for the management of collections and payments deriving from the performance of contracts.

The complete list of data processors can be consulted upon request to be transmitted to the Data Controller using the addresses indicated in Paragraph 9 below.

8. TRANSFER OF PERSONAL DATA TO COUNTRIES OUTSIDE THE EUROPEAN UNION

Your personal data will not be transferred outside the European Union.

If this happens, with reference to the data collected using cookies, the Data Controller, to the extent of its competence, will adopt appropriate guarantees, including the adequacy decisions in force and the standard contractual clauses (Standard Contractual Clauses) adopted by the European Commission.

9. RIGHTS OF DATA SUBJECTS

The rights related to the personal data that Rizoma s.r.l. processes are, pursuant to articles 15 et seq. of Regulation (EU) 679/2016:

• Right to rectification. You can obtain the rectification of personal data concerning you or communicated to us by you. Rizoma makes reasonable efforts to ensure that the personal data in its possession is accurate, complete, up-to-date and relevant, based on the latest information available;
• Right to Restriction. You can obtain a restriction on the processing of your personal data if:

• • question the accuracy of your personal data during the period in which Rizoma must verify its accuracy;
  • the processing is unlawful and you request a restriction of processing as an alternative to deleting your personal data;
  • Rizoma no longer needs to keep your personal data but you do need it to ascertain, exercise or defend your rights in court or
  • you object to the processing while Rizoma checks whether its legitimate reasons prevail over yours.

• Right to access. You may ask Rizoma for information about the personal data held about you, including information about which categories of personal data Rizoma owns or controls, for what purpose it is used, where it was collected (if not directly from you), and to whom it may have been communicated;
• Right to portability. Following your request, Rizoma will transfer your personal data to another Data Controller, if technically possible, provided that the processing is based on your consent or is necessary for the performance of a contract.
• Right to erasure. You may obtain from Rizoma the deletion of your personal data if:
  • personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
  • you have the right to object to further processing of your personal data and you exercise this right to object;
  • personal data has been processed unlawfully, unless the processing is necessary by virtue of legal obligations, by law or in order to establish, exercise or defend a right in court.

• Right to object. You can object to the processing of your personal data at any time, provided that the processing is not based on your consent but on the legitimate interests of Rizoma or third parties. In such cases, Rizoma will no longer hold your personal data unless it is possible to demonstrate the mandatory and legitimate reasons, a prevailing interest in the processing or assessment, or the exercise or defence of a right in court. If you object to the processing, it is appropriate and useful to specify whether you intend to delete your personal data or limit its processing.
• Right to lodge a complaint. In the event of an alleged violation of applicable privacy law, you may file a complaint with the competent authorities of your country or the place where the alleged violation occurred.

Data subjects may exercise the rights listed and described above:

• by contacting the Company’s Privacy Office, by post to the address: Ferno (VA), via Quarto 30/32/34 
• by email at: privacy@rizoma.com

Data subjects, moreover, in the event that the processing is based on consent or contract and is carried out with automated tools, have the right to receive the data in a structured, commonly used and machine-readable format, as well as, if technically feasible, to transmit it to another data controller without hindrance.

Data subjects have the right to lodge a complaint with the competent Supervisory Authority in the Member State in which they habitually reside or work or in the State in which the alleged infringement occurred.

 

10. CHANGES TO THIS PRIVACY POLICY

Any future changes or additions to the processing of personal data as described in this Privacy Policy will be notified through the usual communication channels used by Rizoma (for example through the site).