Privacy Policy regarding the processing of personal data

pursuant to and for the purposes of Art. 13 of the new European Regulation 2016/679 on the protection of individuals with regard to the processing of personal data (GENERAL DATA PROTECTION REGULATION – GDPR).

As required by the General Data Protection Regulation of the European Union (GDPR 2016/679, Article 13), before proceeding with the processing, the Data Subject (user of the website www.lucedisorrento.it) is informed that the personal data collected through the site are processed by the Company using electronic and/or telematic tools, for the purposes indicated in this policy.

To this end, the Privacy Policy prepared by Nature Health lab S.r.l. (hereinafter also “LUCE DI SORRENTO” or “the Company” or “the Data Controller”), creator and promoter of the activities available on the site www.lucedisorrento.it, is submitted to the data subject.

Data Controller

The Data Controller for personal data is Nature Health lab S.r.l., with registered office in Viale Cavour, 51 – 25015 Desenzano del Garda (BS) - Italy, e-mail info@lucedisorrento.it
For further information regarding the rights of the data subject, please refer to the section entitled “Rights of Data Subjects” in this policy.

Information on Processing

The personal data subject to processing are collected directly by Nature Health lab S.r.l. or by third parties expressly authorized by it, or communicated by the Company to such third parties for the pursuit of the purposes described below.

Legal Basis and Purposes of Processing

Personal data provided by the user while browsing the website www.lucedisorrento.it are processed by the Data Controller in compliance with the current regulations on Personal Data Protection.
The legal basis for the processing is the provision of its services by the Company, the management and facilitation of the website, as well as the establishment, execution, and potential termination of the online sales contract concluded between the parties and the obligations connected to the same contract and/or directly and/or indirectly deriving from it.
The processing of personal data by LUCE DI SORRENTO is aimed at pursuing the following purposes:

1) SUBSCRIPTION TO THE LUCEDISORRENTO.IT NEWSLETTER: in the event that the user decides to subscribe to the “LUCE DI SORRENTO Newsletter”, only following potential and specific consent, personal data will be processed by the Data Controller for sending commercial or promotional communications, updates regarding, for example, the latest trends, new arrivals, exclusive offers, special events, and promotions. To unsubscribe from the newsletter, simply click on the appropriate link provided at the bottom of the emails received or write to the address info@lucedisorrento.it

2) REGISTRATION ON LUCEDISORRENTO.IT: in the event that the user decides to register on the website www.lucedisorrento.it, only following potential and specific consent, personal data will be processed by the Data Controller for the purpose of registration on www.lucedisorrento.it. In particular, upon provision of their name, surname, e-mail address, and the setting of an access password, these will be processed for the creation of a personal account, to speed up the purchasing procedure, to allow the user to view order status and receive updates on purchases made, modify personal settings and update the account, view return history and exchange requests, and save favorite items in the Wishlist.

3) ONLINE SHOPPING ACTIVITIES: the personal data provided will be used for the purposes of establishing, managing, executing and/or concluding the online sales contract. The provided data will be processed by the Data Controller for the purpose of managing the purchase order with reference, by way of example, to payment activity, shipping, handling of any returns, customer support, and for the performance of administrative-accounting purposes related to order management, and for the fulfillment of obligations provided by current legislation. In case of payment by credit card, the information essential for the execution of the transaction (credit/debit card number, expiry date, security code) will be processed by SETEFI or, potentially, by companies in charge of anti-fraud control via encrypted protocol, without third parties having any access to it. Such information will in any case never be viewed or stored by the seller (Nature Health lab S.r.l.).

4) PROFILING OF THE NATURAL PERSON: only following potential and explicit consent, the personal data provided may be processed by the Data Controller for profiling activities, i.e., analysis of preferences aimed at creating personalized content and offers.

Nature of Processing

In relation to the purposes referred to in point 1) of the previous paragraph, the provision of personal data and consent to their processing is optional. Failure to provide consent makes it impossible for LUCE DI SORRENTO to allow subscription to the “LUCE DI SORRENTO Newsletter”, or to send commercial or promotional communications and updates regarding, for example, the latest trends, new arrivals, exclusive offers, special events, and promotions.
Should the user decide to proceed with the newsletter subscription through the section of the site exclusively dedicated to this activity, the provision of personal data and consent to their processing is mandatory.
Failure to provide consent makes it impossible for LUCE DI SORRENTO to allow subscription to the “LUCE DI SORRENTO Newsletter”, or to send commercial or promotional communications and updates regarding, for example, the latest trends, new arrivals, exclusive offers, special events, and promotions.

In relation to the purposes referred to in point 2) of the previous paragraph, the provision of personal data and consent to their processing is mandatory. Failure to provide consent makes it impossible for LUCE DI SORRENTO to allow registration on www.lucedisorrento.it, the creation of a personal account, the speeding up of the purchasing procedure, the viewing of order status, the receipt of updates on purchases made, the ability for the user to modify personal settings and update the account, the viewing of return history and exchange requests, and the saving of favorite items in the Wishlist.

In relation to the purposes referred to in point 3) of the previous paragraph, the provision of personal data and consent to their processing is mandatory. Failure to provide consent makes it impossible for LUCE DI SORRENTO to proceed with the establishment, management, execution and/or conclusion of the online sales contract; therefore, it is impossible to perform, by way of example, activities related to payment, shipping, the handling of any returns, customer support, the performance of administrative-accounting purposes related to order management, and the fulfillment of obligations provided by current legislation.

In relation to the purposes referred to in point 4) of the previous paragraph, the provision of personal data and consent to their processing is optional.
Failure to provide consent makes it impossible for LUCE DI SORRENTO to carry out profiling activities, i.e., to perform analysis of preferences aimed at the creation of personalized content and offers.

Personal Data Processed

The personal data processed by the Controller are those provided by the user while browsing the website www.lucedisorrento.it, during any registration/subscription to services/programs made available by LUCE DI SORRENTO, and/or during any purchase of products made available by LUCE DI SORRENTO, such as, by way of example: name, surname, and e-mail address, in addition to the data necessary for the provision of the online sales service such as, for example, those functional to the execution of payment and the shipping/exchange of purchased products.

Methods of Processing and Data Storage

The processing of personal data is carried out by the Controller in compliance with the provisions of current Privacy legislation. The Controller carries out the processing of personal data using electronic and/or telematic tools and with organizational and logical methods strictly related to the pursuit of the purposes indicated in this policy, as well as by adopting appropriate security measures to prevent unauthorized access, disclosure, modification, or destruction of personal data, as well as their loss and illicit or incorrect use. However, the Company cannot guarantee to its users that the measures taken for the security of the site and the transmission of data and information on the site are able to limit or exclude any risk of unauthorized access or dispersion of data by devices pertaining to the user. For this reason, we suggest that site users ensure that their computer is equipped with adequate software for the protection of data transmission over the network (for example, updated antivirus) and that their Internet Provider has adopted suitable measures for the security of data transmission over the network. The Company also undertakes to process data according to the principles of correctness, lawfulness, and transparency, to collect them to the extent necessary and accurate for the processing, and to allow their use only by authorized personnel for this purpose. The management and storage of the acquired personal data will take place in archives or on servers located within the European Union owned by the Controller and/or third-party companies appointed as External Data Processors and, in any case, currently located in Italy.
In relation to the various purposes for which they are collected, personal data will be kept for the time strictly necessary to achieve them and, in any case, in compliance with the applicable legal provisions.
In any case, the Company will take care to avoid the use of data indefinitely, proceeding periodically to verify the actual continuation of the interest of the subject to whom they refer.

Recipients and Data Processors

The collected data will not be disseminated in any way, but will be processed within the limits and for the purposes described by employees of the Company on the basis of appropriate operating instructions (for example, administrative, commercial, marketing, legal staff, system administrators, etc.). Some data processing may also be carried out by third parties, appointed as External Data Processors, which the Controller uses or may use within the scope of managing the contractual relationship, providing offered services, and for organizational needs of its business. In particular, the data could be communicated to:

a) public and private entities, which can access the data by virtue of provisions of law, regulation, or community legislation, within the limits provided by such rules;
b) entities that need to access the data for purposes related to the contractual relationship in existence between the parties, within the limits strictly necessary for the performance of auxiliary tasks (such as, for example, banks and credit institutions, technical service providers, hosting providers, IT companies, communication agencies, postal couriers, and shipping companies);
c) consultants, within the limits necessary for the performance of their professional mandate.

The updated list of External Processors and subjects authorized to process is kept at the registered office of the Data Controller and is available to the Data Subject upon request to be made via e-mail to info@lucedisorrento.it

Data Transfer Abroad

The management and storage of personal data will take place on servers of the Controller and/or third-party companies duly appointed as External Processors located within the European Union.
Personal data may be transferred abroad, in accordance with the provisions of current legislation, even to countries not belonging to the European Union. The transfer to non-EU countries, in addition to the cases where this is guaranteed by Adequacy Decisions of the Commission, is carried out in a way that provides appropriate and suitable guarantees pursuant to Articles 46, 47, or 49 of the Regulation.

Rights of Data Subjects

As a Data Subject, the user may exercise, at any time, the rights provided by articles 15, 16, 17, 18, 20, and 21 of the GDPR, which confer, in particular, the right to:

a) obtain from the Data Controller, pursuant to Article 15, confirmation as to whether or not personal data concerning them is being processed, and in such case, obtain access to the data and information such as: (i) the purposes of processing; (ii) the categories of personal data; (iii) the recipients or categories of recipients to whom the personal data have been or will be communicated, in particular if they are recipients located in Third Countries or International Organizations; (iv) when possible, the envisaged storage period of the personal data or, if not possible, the criteria used to determine such period;
b) obtain from the Data Controller, pursuant to Article 16, the rectification of inaccurate personal data concerning them without undue delay; taking into account the purposes of the processing, the data subject has the right to obtain the completion of incomplete personal data, including by providing a supplementary statement;
c) obtain from the Data Controller, pursuant to Article 17, the erasure of personal data concerning them without undue delay. The Controller has the obligation to erase, without undue delay, the personal data if one of the reasons indicated in paragraph 1 of Article 17 exists;
d) obtain from the Data Controller, pursuant to Art. 18, the restriction of processing when one of the hypotheses governed by paragraph 1 of Article 18 occurs;
e) obtain from the Data Controller, pursuant to Article 20, the portability of data, i.e., to receive in a structured, commonly used, and machine-readable format the personal data concerning them provided to a Data Controller. The Data Subject also has the right to transmit such data to another Data Controller without hindrance from the first Data Controller to whom they provided them, if the conditions indicated in Article 20, paragraph 1, are met. Finally, the Data Subject has the right to obtain the direct transmission of personal data from one Data Controller to another, if technically feasible;
f) object, in whole or in part, pursuant to Article 21, to the processing of personal data concerning them.
To exercise their rights, the user can transmit their requests to info@lucedisorrento.it
We also point out that the Data Subject has the right to revoke consent at any time without prejudice to the lawfulness of the processing based on the consent provided before the revocation, without prejudice to the consequences mentioned above regarding a potential refusal to provide such personal data. The Data Subject also has the right to lodge a complaint with a Supervisory Authority.
You may submit requests regarding the exercise of these rights by contacting the Data Controller at the e-mail address info@lucedisorrento.it.

Nature Health Lab S.r.l. undertakes to respond to the Data Subject’s requests within one month, except in cases of particular complexity for which it could take a maximum of three months. In any case, the Data Controller will provide evidence to the Data Subject of the reason for the delay within one month of the request. The outcome of the request will be provided in writing or in electronic format. In case of a request for rectification, erasure, as well as restriction of processing, the Data Controller undertakes to communicate the results of the requests received from the Data Subject to each of the recipients of their data, unless this proves impossible or involves a disproportionate effort.
The Company specifies that a contribution may be requested from the Data Subject if the requests are manifestly unfounded, excessive, or repetitive; in this regard, the Data Controller will adopt a register to track intervention requests.

Changes to this Policy

The Data Controller reserves the right to make changes to this Privacy Policy at any time by giving notice to users on the website www.lucedisorrento.it. Please therefore consult this page frequently, referring to the date of the last modification indicated at the end of the document. If the changes made to this Privacy Policy are not accepted, the Data Subject may request that the Data Controller delete their personal data. Unless otherwise specified, the previous Privacy Policy will continue to apply to personal data collected up to that time.

Privacy Policy updated on 25/10/2020