GDPR Privacy Notice for Private Clients

EU REGULATION 2016/679 (GDPR), Legislative Decree 101/2018, amended Legislative Decree 196/2003 PRIVACY NOTICE FOR CLIENTS

Please note:

The Data Controller determines the purposes and methods of personal data processing.
The Data Controller promotes, offers, and provides goods and services to its clients.
In the course of providing such goods and services, the Data Controller manages the Client’s personal data.

The following information is provided:

DATA CONTROLLER – The Data Controller (hereinafter “Controller”) is ARREDAMENTI IVAN TUANI S.R.L., VAT No. 10103000963, headquartered at Via Maestri del Lavoro 8/10 – 20813 BOVISIO MASCIAGO (MB), Tel. +39 0362 594497, Email: info@ivantuani.it, Certified Email (PEC): ivantuanisrl@pec-certif.it

PURPOSES OF PROCESSING – All personal data processing operations are carried out for the following purposes:

To establish and execute contractual relationships, including the acquisition of preliminary and preparatory information for contract conclusion, as well as any pre-sales and after-sales support;
To comply with legal obligations, including tax, accounting, commercial practices, and anti-money laundering regulations;
To manage administrative, accounting, ordering, shipping, invoicing, and related services, including handling of disputes;
To send commercial communications promoting the Controller’s products and services;
To protect legal rights and credit positions resulting from the contract;
To compile internal-use statistics.

LEGAL BASIS FOR PROCESSING – The legal basis for processing personal data includes:

Processing necessary for the performance of a contract or pre-contractual measures requested by the data subject;
Processing necessary to comply with a legal obligation;
Processing necessary for the legitimate interests pursued by the Controller.

PROVISION OF PERSONAL DATA – The provision of personal data is necessary for the purposes indicated above. Refusal to provide such data may prevent the Controller from initiating or continuing the relationship with the data subject.

METHODS AND ACTIVITIES OF DATA PROCESSING – Data processing is carried out using both automated (digital and computerized) and non-automated (paper-based) methods, in accordance with applicable privacy and security laws and the Controller’s internal policies. Processing activities include: data collection, recording, access, consultation, archiving, and communication. No automated decision-making, including profiling, is carried out.
LOCATION OF DATA PROCESSING – Personal data is processed at the offices of ARREDAMENTI IVAN TUANI S.R.L., Via Maestri del Lavoro 8/10 – 20813 BOVISIO MASCIAGO (MB), and may also be processed by external companies or professionals on behalf of the Controller, to the extent required for the services provided.
DISCLOSURE OF PERSONAL DATA – Personal data may be disclosed to authorized internal personnel and to external entities, within the limits necessary to perform assigned services, while maintaining confidentiality and data security. External recipients may include:

Tax, labor, and occupational health and safety consultants/companies;
Banks and credit insurance companies;
Public and private authorities, including tax police and judicial authorities, for inspections or investigations.

TRANSFER OF PERSONAL DATA ABROAD – Personal data is not currently transferred outside of Italy. If such a need arises, the Controller will obtain specific consent, detailing the destination country and safeguards adopted to ensure compliance with applicable regulations.

DATA RETENTION PERIOD – Data may be stored for the duration of the commercial relationship and, depending on the context, beyond that, as follows:

After contract termination: 10 years;
For administrative, accounting, ordering, estimating, production workflow, support and maintenance, shipping, invoicing, and service management: 10 years, as per Art. 2220 of the Italian Civil Code, subject to any extended retention due to late payments;
For commercial communications by the company promoting its products and/or services directly: 24 months, subject to the client’s right to opt-out at any time.

DATA SUBJECT RIGHTS – The data subject may exercise the right to access and data portability, and may request updates, corrections, or additions. Where applicable, they may also request erasure, restriction, or object to processing. In cases of unlawful processing, the data subject may lodge a complaint with a supervisory authority. Consent may be revoked at any time, without affecting mandatory legal obligations in place at the time of the revocation, by contacting the Controller.

Data Controller