Policy on personal data processing based on REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 (GDPR)

Introduction

The Data Controller is Reschio S.r.l., with registered office in Lisciano Niccone (PG), località Fattoria di Reschio snc, cap 06060, Italy, Chamber of Commerce of Perugia, VAT number IT05230420480, share capital of 50,000.00 € fully paid (Castello di Reschio) owner of the website www.reschiocollections.com (Website).

Purchasing through the Website

Castello di Reschio shall acquire and process your personal data to process your request to purchase through the Website.

Profiling

If you provide your explicit consent, Castello di Reschio shall process your personal data for the analysis of your consumer choices and purchasing habits (known as “profiling”), through a study of the type and frequency of your online purchases, in order to send newsletter and/or advertising material from Castello di Reschio or third-parties that may be of particular interest to you.

Soft Spamming

Castello di Reschio is entitled to sale its services using the email that you communicated during your first purchase on the Website, if this service is similar of the first sale (soft spamming). You may at any time notify Castello di Reschio of your refusal to receive this type of communication.

***

Pursuant to the GDPR, Castello di Reschio shall process the personal data provided by you as indicated in this privacy policy.

Article 1. Purpose of the processing. Legal basis. Mandatory or optional nature of data provision and consequences of any refusal.

Castello di Reschio shall process the personal data provided by you for the following purposes:

a. in the case of making an online purchase order, to allow the conclusion of the purchase contract and the proper execution of transactions related to the same (and, if necessary under the legislation, to fulfill tax, administrative, accounting and public security obligations). This treatment of personal data also includes the possibility of sending communications (e.g. tracking, order information and requests for reviews) via automated tools such as email and/or SMS. The legal basis for the processing is the obligation of Castello di Reschio’s to execute the contract with the data subject or to comply with legal obligations. The provision of data is purely optional. However, as the said processing is necessary in order to enable you to provide the purchasing your refusal to provide the relevant data will prevent you from completing an purchase;

b. limited to the email address provided by you when purchasing services offered, to enable the direct sale of similar services (soft spamming), without requiring your express and prior consent and provided that you do not exercise your right to object. The legal basis for the processing is Castello di Reschio's legitimate interest to perform these activities. This legitimate interest is equal to the user's interest to riceve "soft-spam" comunication;

c. if you provide your explicit consent, for the analysis of your consumer choices and purchasing habits (known as “profiling”), by Castello di Reschio, through a study of the type and frequency of your online purchases, in order to send informative and/or advertising material about services and/or products of Castello di Reschio and / or third-parties, that may be of particular interest to the user, by email (profiling purposes). The legal basis for the processing is your consent. Consent to profiling purposes is purely optional. Failure to consent to the processing of personal data for profiling purposes will prevent Castello di Reschio from studying the type and frequency of your online purchases, in order to send to you newsletter and/or advertising material that may be of particular interest to you regarding services and/or of Castello di Reschio and/or third-parties;

d. in order to answer to your requests by email, by telephone. The provision of data is purely optional. However, as the said processing is necessary in order to respond to your request, your refusal to provide the relevant data will prevent you from obtaining answer from the customer care of Castello di Reschio. The legal basis for the processing is Castello di Reschio's legitimate interest to perform these activities. This legitimate interest is equal to the user's interest to receive answer by Castello di Reschio.

It is understood that Castello di Reschio may use your personal data to comply with legal obligations and to perform the purchase contract.

You may revoke your consent using the relevant link indicated in any promotional email sent by Castello di Reschio.

Special Categories of Personal Data. Judicial Data

Castello di Reschio does not process special categories of personal data nor judicial data.

Article 2. Methods of Processing Personal Data

The processing of your personal data will be carried out by electronic or automated means, in the manner and with the appropriate tools to ensure the security and confidentiality in accordance with the GDPR.

The information and methods of processing will be relevant and not excessive in relation to the type of services provided. Data will be managed and protected in environments where access is under constant control.

Article 3. Data Disclosure

For the purposes described in this privacy policy, the personal data provided by you may be disclosed or communicated to the following parties:

• to all those parties (including Public Authorities) that have access to the data by virtue of regulatory or administrative measures;

• to parties who process online payment transactions;

• to post offices, couriers or forwarding agents responsible for the delivery of the products purchased through the Site;

• to companies, consultants or professionals in charge of the installation, maintenance, updating and the management of Castello di Reschio's hardware and software or which Castello di Reschio uses for the provision of its services;

• to the companies that send the newsletters and/or other informative communications transmitted on behalf of Castello di Reschio;

• to Castello di Reschio’s employees and/or collaborators;

• to all those public and/or private parties, natural and/or legal persons (legal, administrative and tax consultancy firms), where the communication is necessary or of practical use for the correct fulfilment of contractual obligations undertaken in relation to the services provided through the Website, and of legal obligations.

The subjects to whom Castello di Reschio transmits your data may be data processors who are designated by Castello di Reschio by means of a specific contract or persons in charge of processing personal data under the direct authority of Castello di Reschio or, in the case of third parties employed by the Data Processor, sub-processors, pursuant to art. 28.4 of the GDPR.

Your data may be disclosed only in anonymous and aggregated form for statistical or research purposes.

Article 4. Data Controller

You can contact Castello di Reschio, as Data Controller, at the following addresses:

Reschio S.r.l., Lisciano Niccone (PG), località Fattoria di Reschio snc, cap 06060 Italy

By email, writing to: customercare@reschio.com

The Data Controller has also appointed a Data Protection Officer (DPO), who can be contacted by you at the following email: privacy@reschio.com

Article 5. Data Storage

Personal data will be stored according to the following logics:

• for profiling purposes, personal data will be kept for 24 months. At the end of this period, Castello di Reschio may ask you to renew your consent to the processing of your data or to make them anonymous and keep them only for statistical or historical purposes;

• for the purpose of executing the sales contract, for 10 years from the date of receipt of the purchase order;

• as provided for in Article 2220 of the Civil Code, invoices, as well as all accounting records in general, are kept for a minimum period of ten years from the date of registration, so that they can be presented in the event of an audit;

• for the purpose of defense in court, until the judgment becomes final; • for the purpose of complying with legislation, for the time necessary for this purpose; • for the purpose of performing any service requested through the Site, for the time necessary to execute the request;

• For customer care purposes, data will be deleted once the service is completed.

Article 6. Transfer of Personal Data to Third Countries

Castello di Reschio is based within the European Union. Therefore, the processing of your data is safe from a regulatory point of view as it is governed by the GDPR.

If the transfer of your personal data takes place in a non-EU country and for which the European Commission has issued an adequacy opinion, the transfer is in any case considered safe from a regulatory point of view.

Your personal data may be transferred to the USA based on what is established by the adequacy decision of the European Commission. With this decision, the European Commission has determined that the USA provides personal data protection comparable to that offered by the European Union.

Your data may also be transferred to countries outside the EU for which the European Commission has not issued an adequacy opinion. You are therefore invited to access this article regularly to check whether the transfer of your personal data takes place in a Third Countries.

Article 7. Rights of the Data Subject

Purstuant to GDPR (Article 13), you have the right to:

• request access to and rectification or erasure of personal data or restriction of processing or object to their processing, in addition to the right to data portability

• withdraw consent at any time without prejudice to the lawfulness of processing based on consent given prior to the withdrawal

• lodge a complaint before a supervisory authority (for instance, the Italian Data Protection Authority).

The above-mentioned rights may be exercised by making a request to at the contacts indicated above.

Article 8. Amedments Castello di Reschio reserves the right to change this privacy policy at any time, giving suitable notice to users and ensuring in any case an adequate and similar protection of personal data. In order to view any changes, you are invited to regularly consult this privacy notice.