The undersigned La Fonte del Cerro snc (hereinafter Saturnia Gioielli ) informs you that, for the data you provide via the website https://s aturniagioielli .com/, Boutique Saturnia is the controller of your data classified as personal data pursuant to EU Regulation (Reg. 2016/679 of 27 April 2016). In accordance with the provisions of the aforementioned Regulation, we provide the following information, in compliance with Articles 13 and 14 of the aforementioned EU Regulation. The information and data provided by you or otherwise acquired in connection with the use of Boutique Saturnia services (such as newsletters), will be processed in compliance with the provisions of the Regulation and the confidentiality obligations that inspire the activity of Boutique Saturnia . In accordance with the provisions of the Regulation, the processing carried out by Boutique Saturnia will be based on the principles of lawfulness, fairness, transparency, purpose and retention limitation, data minimization, accuracy, integrity, and confidentiality.

1) Data types
Following your navigation of the Sites, we inform you that Saturnia Gioielli will process personal data (art. 4(1) of the Regulation), hereinafter referred to only as “Personal Data”.

In particular, the Personal Data processed through the Sites are the following:

a) Navigation data:

The computer systems and software procedures used to operate the Sites acquire, during their normal operation, some Personal Data whose transmission is implicit in the use of Internet communication protocols. This information is not collected to be associated with identified data subjects, but by its very nature could, through processing and association with data held by third parties, allow users to be identified. This category of data includes the IP addresses or domain names of computers used by users connecting to the Sites, the URI (Uniform Resource Identifier) ​​addresses of requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response from the server (successful, error, etc.), and other parameters relating to the user's operating system and IT environment. This data is used solely to obtain anonymous statistical information on the use of the Sites and to monitor their proper functioning (see this Policy below on Cookie Policy), to identify anomalies and/or abuse, and is deleted immediately after processing. The data may be used by the competent authorities to ascertain liability in the event of hypothetical cybercrimes against the sites.

b) Data provided voluntarily by the interested party:

Aside from what is specified for navigation data, the user is free to provide personal data in any request forms on the websites (e.g., to subscribe to newsletters, request information and/or product notifications, etc.). Failure to provide such data may make it impossible to provide the service. When using certain Website Services, the Personal Data of third parties sent by you to Da Oriente a Saturnia Gioielli may be processed. In such cases, you are the independent data controller, assuming all legal obligations and responsibilities. In this regard, you hereby fully indemnify Boutique Saturnia against any dispute, claim, request for compensation for damages resulting from processing, etc., that may be received from third parties whose Personal Data has been processed through your use of the Website functions in violation of applicable data protection laws. In any case, if you provide or otherwise process third-party Personal Data while using the Sites, you hereby guarantee—assuming all related liability—that such specific processing is based on an appropriate legal basis pursuant to Article 6 of the Regulation, which legitimises the processing of the information in question.

2) Object of the treatment
The Data Controller processes the personal identification data (for example: name, surname, company name, address, telephone number, email address) provided by you when establishing and/or executing contractual relationships with the Data Controller.

3) Purpose and Methods of Processing.
The Data Controller processes the personal identification data (for example: name, surname, company name, address, telephone number, email address, bank and payment details, tax code) – (hereinafter, “personal data” or also “data”) communicated by you when establishing and/or executing contractual relationships with the Data Controller.

The personal data you provide are processed:

to) Without your express consent (art. 6 letter b), e) GDPR), for the following purposes:

• conclude contracts with the Owner;
• fulfill pre-contractual, contractual and tax obligations arising from existing relationships with you;
• for the purposes of protecting credit rights and better managing our rights relating to the individual contractual relationship in place with you;
• fulfill obligations established by law, by a regulation, by community legislation or by an order of the Authority (such as for example in anti-money laundering matters);
• exercise the rights of the Data Controller (such as the right to defense in court).

This information is requested in the sections of the site and when placing an order.

b) Only with your express consent (Article 7 GDPR), for the following purposes:

• send you via email, post and/or SMS and/or WhatsApp and/or telephone contacts, newsletters, commercial communications and/or advertising material on products or services offered by the Data Controller and survey the level of satisfaction with the quality of the products and services;
• send you via email, post, and/or text message, and/or WhatsApp, and/or telephone contact for market analysis, statistics, and quality control, marketing operations, and information on future commercial initiatives, new products, and services;
• send you via email, post and/or SMS and/or WhatsApp and/or telephone contacts for the execution of promotional initiatives in general.

The personal data you provide will be processed in compliance with the aforementioned legislation and the confidentiality obligations that govern the Data Controller's activities. The data will be processed using both computerized tools and paper-based media, as well as any other suitable media, in compliance with the appropriate technical and organizational security measures required by the GDPR.

4) Communication of Data
Without the need for express consent (Article 6, letters b) and c) of the GDPR), the Data Controller may disclose your data for the purposes referred to in point 1 to supervisory bodies, judicial authorities, insurance companies for the provision of insurance services, as well as to those entities to whom disclosure is required by law for the fulfillment of the aforementioned purposes. These entities will process the data in their capacity as independent data controllers. Your data will not be disclosed.

5) Data recipients
Within the limits relevant to the processing purposes indicated, your data may be disclosed to the Data Controller's employees and collaborators; to affiliated companies, subsidiaries, and affiliates; to business partners; to parent companies; to factoring companies; to credit institutions; to debt collection companies; to credit insurance companies; to professionals and consultants; to companies operating in the shipping and transportation sector; to our subcontractors if engaged in carrying out activities related to our contractual relationships; to persons specifically appointed and/or authorized by the Data Controller who provide data processing, consulting, and financial statement certification services, or who otherwise perform activities that are instrumental, complementary, and functional to those of the Data Controller in carrying out activities related to the existing contractual relationship; and also to all persons to whom disclosure is required by law.

6) Transfer of data abroad
Personal data collected from access to the boutiquesaturnia.com e-commerce site, processed by "La Fonte del Cerro snc.", is stored on servers located in the EU. The website https://boutiquesaturnia.com/ is powered by the Shopify e-commerce platform. Shopify's privacy policy can be found at the following links:

https://help.shopify.com/manual/your-account/GDPR
https://help.shopify.com/assets/pdfs/gdpr-whitepaper.pdf

7) Legal basis of the Processing.
The lawfulness of the processing is constituted by the optional consent for the sole processing of personal data for specific marketing, promotional, and informational purposes (Article 6, paragraph 1, letter a).

8) Refusal to consent to the Processing
With reference to the purposes listed in Article 3, the provision of data is mandatory with regard to those expressed in point 1 as it is necessary to fulfill the purposes themselves.

Providing data for the purposes listed in point 2 above is optional. You can therefore decide not to provide any data or subsequently deny the processing of data already provided.

9) Data Retention
The collected data will be retained for a period of time no longer than is necessary to achieve the purposes for which they are processed (principle of storage limitation, art. 5, GDPR) or in accordance with the deadlines established by law.

10) Rights of the interested party
As a data subject, you have the rights set forth in Article 15 of the GDPR, specifically the rights to:

to) Obtain confirmation of the existence or otherwise of personal data concerning you, even if not yet recorded, and their communication in an intelligible form;

b) Get directions:

the. On the origin of personal data;

ii. Of the purposes and methods of processing;

iii. Of the logic applied in the case of processing carried out with the aid of electronic instruments;

iv. The identifying information of the data controller, data processors, and the designated representative pursuant to art. 3, paragraph 1, GDPR;

v. Of the subjects or categories of subjects to whom the personal data may be communicated or who may become aware of them in their capacity as designated representative in the territory of the State, managers or persons in charge;

c) Obtain:

the. The updating, rectification or, when relevant, integration of the data;

ii. The deletion, transformation into anonymous form or blocking of data processed in violation of the law, including data whose retention is not necessary in relation to the purposes for which the data were collected or subsequently processed;

iii. Certification that the operations referred to in letters i) and ii) have been brought to the attention, including with regard to their content, of those to whom the data have been communicated or disseminated, except in the case in which such fulfillment proves impossible or involves the use of means manifestly disproportionate to the right protected;

d) Object, in whole or in part:

the. For legitimate reasons, the processing of personal data concerning you, even if pertinent to the purpose of collection;

ii. To the processing of your personal data for the purpose of sending advertising or direct sales materials or for market research or commercial communications, through the use of automated calling systems without human intervention, via email and/or through traditional marketing methods such as telephone and/or postal mail. Please note that the data subject's right to object to direct marketing purposes via automated means extends to traditional methods, and that the data subject retains the right to object even partially. Where applicable, you also have the rights set forth in Articles 16-21 of the GDPR (right to rectification, right to be forgotten, right to restriction of processing, right to data portability, right to object), as well as the right to lodge a complaint with the Supervisory Authority.

11) Data Controller
The Data Controller is La Fonte del Cerro snc di Tanturli Maurizio e Monia – with registered office at SP 10 della Follonata Km 3.5, 58014 Saturnia (GR), Italy – VAT and Tax Code 01564720538. To contact the Data Controller, including to exercise your rights, you can write to the address above or email: s aturniagioielli@gmail.com . You may request an updated list of parties who may access the data processed by the Data Controller at any time.