Privacy policy

By this privacy policy drafted pursuant to Art. 13 European Reg. n. 679/2016 ("Regulation" or "GDPR") and in compliance with the principles contained therein, Tre Ponti S.r.l. intends to inform each user, whether registered or not, ("User" or in the plural "Users") about the processing of personal data collected and processed on the website www.treponti.com ("Site") and on the platform hosting the e-commerce www.treponti.com ("E-commerce").

Any third-party websites accessible through links remain subject to the privacy policy provided by the site manager of the relevant third-party site. The User is encouraged to review these documents before browsing the third-party sites.

Tre Ponti S.r.l. (hereinafter the "Controller" for the purposes of Art. 4(7) GDPR), with registered office in Piazza Aldo Moro, 7 - 31020 Villorba (TV), C.F./P.IVA 04982290266, e-mail: shop@treponti.com

For the purposes specified in par. 3, the Controller processes the User's personal data, specifically:

• - anagraphic information (i.e. first and last name, date of birth);
• - contact information (i.e., phone number, e-mail);
• - account login credentials (i.e., username, password);
• - address and shipping information;
• - payment data;
• - accounting and tax data;
• - data collected as part of surveys on the quality of products and services;
• - website usage data;
• - purchase history;
• - wishlist.

If the User shares data of third parties to the Controller (e.g. payment data of a third party who performs the payment in favor of the User; address and contact data of a party other than the buyer who receives the product), the User acts as an autonomous data controller, assuming all legal obligations and responsibilities. In this sense, the User confers on the point the widest indemnity with respect to any dispute, claim, request for compensation for damages from processing, etc. that may be received by the Controller from third parties whose personal data have been processed in violation of the provisions on the protection of personal data. In any case, if the User provides or otherwise processes personal data of third parties in the use of the Site, he guarantees as of now - assuming all related responsibility - that this particular hypothesis of processing is based on a suitable legal basis under Article 6 of the GDPR that legitimizes the processing of the information in question.

The Controller acquires and processes Users' personal data for the purposes specified below. Processing is legitimized by the legal basis highlighted for each purpose under Article 6 of the Regulations. 

The data will be stored in a form that allows the identification of the data subjects for a period not exceeding the achievement of the stated purposes, in accordance with the principle of minimization in Article 5.1 c) GDPR.

 

	Purpose	Legal Basis	Data Retention
a.	Provision of the services offered through the Site and E-Commerce.  Personal data will be processed to provide the User with the requested services, including but not limited to registration and access to the Site and E-Commerce, account management, wishlist management, order history consultation, order status check, etc.	Execution of a contract [Art. 6.1(b) GDPR]	The data will be kept until the account is deleted.
b.	Processing and management of delivery order, product shipment and contractual fulfillment. Data will be processed in order to fulfill orders, handle payment transactions, deliver products and fulfill obligations arising from the sales contract.	Execution of a contract  [Art. 6.1(b) GDPR]	Personal data will be retained until the expiration of the contract and for 10 years thereafter, except where retention is necessary for the exercise of defense rights.
c.	Processing of report and/or information request and customer care. The data provided will be processed to handle and respond to inquiries and reports, as well as for the purpose of assisting the User before, during and after the purchase of a product.	Execution of pre-contractual and/or pre contractual measures  [Art. 6.1(b) GDPR]	Data will be kept for the period necessary for response.
d.	Customer Satisfaction and improvement of products/services offered. As part of this purpose, your data will be processed to initiate surveys in order to assess the performance of the products marketed and services provided by the Owner and their level of acceptance by Users.	Legitimate interest [art. 6.1 f) GDPR] resulting from the need to improve the services offered to Users.	Personal data will be kept for no more than 6 months after participation in the survey.
e.	Soft spam. Your personal data will be processed for the purpose of sending, via e-mail and/or paper mail, communications having promotional, informative and/or advertising content, in relation to products or services similar to those being sold pursuant to Art. 130 co. 4 Privacy Code.	Legitimate interest  [art. 6.1 f) GDPR] referring to the Controller’s desire to maintain the business relationship with the customer by forwarding communications consistent with the customer's past business experiences.	Personal data will be retained for as long as is strictly necessary to achieve the legitimate interest and until the data subject objects to the processing.
f.	Direct marketing. Your personal data will be processed for sending communications (via sms, e-mail, paper mail, social media, etc.) having promotional, informative and/or advertising content in relation to the products and services marketed by Tre Ponti S.r.l.	Consent [Art. 6.1(a) GDPR]	Personal data will be retained until consent is withdrawn or objection to processing is made, but no longer than 24 months from the date of last contact.
g.	Fulfillment of accounting and administrative obligations. The Owner will process the User's data in order to properly fulfill accounting, administrative obligations and in particular for data entry and processing for the purpose of preparing mandatory accounting records, drafting tax and administrative documents.	Legal obligation  [Art. 6.1(c) GDPR]	Personal data will be kept for accounting, tax and administrative needs, according to applicable regulations.
h.	Improvement of the website. The Owner will process Users' data to enable navigation, consultation of the Site, as well as to improve the experience of browsing the Site.	Legitimate interest [art. 6.1 f) GDPR] attributable to the need of the Owner to enable the enjoyment of the Site and its improvement.	Not applicable (aggregated or anonymized data)
i.	Complaint handling, interest protection and exercise of the right of defense . The Controller may process Users' data to exercise and protect their rights in extrajudicial and judicial proceedings.	Legitimate interest [Art. 6.1 (f) GDPR] resulting from the need to establish, exercise or defend a right and/or interest.	Personal data will be kept for the period necessary to defend or exercise the right.
l.	Interaction with social networks and external platforms. The Site incorporates so-called "social plug-ins" that, through the Site, allow direct access to the institutional social channels of the Owner. Information on how the data is processed there will be provided by the relevant social networks (Facebook, Youtube, Instagram).	Consent [Art. 6.1(a) GDPR]	Data will be retained until consent is withdrawn or objection to processing is made, but no longer than 12 months from the date of last contact.
m.	Storage of User's payment data. Payment information may be stored, with the User's consent, to expedite the purchase process in the future.	Consent [Art. 6.1(a) GDPR]	The data will be retained until consent is revoked or objection to processing is made, but no later than 6 months after the last purchase.
n.	Newsletter. The Controller may process Users' data for the purpose of forwarding them e-mail communications to inform them about events, news, promotions, offers, surveys, and product information.	Consent [Art. 6.1(a) GDPR]	Data will be retained until consent is withdrawn or objection to processing is made, but no longer than 24 months from the date of last contact.

The provision of personal data for the purposes under letter a) and b) is necessary, respectively, for the provision of the services requested by the User and for the completion of the sales agreement. 

The provision of data for purposes sub c) is optional. However, failure to provide it will result in the Controller’s inability to fulfill the request.

The provision of data for the purpose sub f) is optional and does not affect the execution or establishment of the contractual relationship with the person concerned.

The provision of data for the purpose sub (g) is mandatory to fulfill legal obligations.

The provision of data under (d), (e), (h) and (i) is necessary for the Controller to fulfill its legitimate interest.

4. Data Sharing

The User's personal data may be shared with the following entities:

• Companies or professional firms that provide assistance and advice to the Controller in accounting, administrative, legal, tax, financial matters;
• Third parties who perform for the Controller activities instrumental to the achievement of the stated purposes, including IT service providers, technical staff, banking institutions, companies that provide payment services, companies that take care of shipping and delivery of products;
• public subjects to whom such data must be communicated mandatorily by law or orders of any authority.

These subjects may act as data controllers or data processors. In the latter case, the Controller shall formally designate such subjects as data controllers pursuant to Article 28 GDPR.

The list of data processors is available by sending a request to the Controller at e-mail: shop@treponti.com

Personal data will also be processed by the Controller's employees and contractors specifically authorized and instructed by the Controller pursuant to Art. 29 GDPR. 

5. Data Subjects’ rights

The User may exercise all rights provided for in Articles 15-21 of the GDPR at any time and without unjustified limitations. In particular, the User may:

• - Obtain from the Controller confirmation as to whether personal data are being processed;
• - Obtain access to their personal data held by the Controller ex art. 15 GDPR;
• - Obtain rectification of inaccurate or incomplete data in accordance with Article 16 GDPR;
• - Obtain the erasure of data if the conditions of Article 17.1 GDPR are met;
• - Request restriction of processing in the cases provided for in Article 18 of the GDPR; 
• - Transfer their data to another data controller without hindrance under Article 20 GDPR;
• - Object to the processing of data under Article 21 GDPR;
• - with respect to the purposes of processing that are based on consent, revoke it at any time pursuant to Art. 7 GDPR.
  

Requests should be addressed in writing to the Controller at shop@treponti.com

Requests are filed free of charge and processed by the Controller within 30 days.

In any case, Users are always entitled to lodge a complaint with the competent supervisory authority (Garante per la Protezione dei dati personali), pursuant to Article 77 of the GDPR, if it is believed that the Controller processes their Personal Data in violation of the applicable law.

6. Place of data processing

Personal data are processed at the Controller’s headquarters, as well as in the servers hosting the Site and e-Commerce. Personal data are processed at the headquarters of the Controller, as well as in the servers that host the Websites. The Data Controller ensures that when using cloud providers established outside the EEA, the processing of personal data by these recipients is carried out in accordance with applicable law. Transfers shall be carried out by means of appropriate safeguards, such as adequacy decisions, standard contractual clauses approved by the European Commission or other safeguards provided for in the GDPR.

The Controller reserves the right to amend and update this Privacy Policy as a result of any further new or revised provisions of any national and EU laws and regulations on personal data protection.The Owner will inform Users of such changes, these will be binding as soon as they are transmitted or otherwise made available to them.