Information on the processing of personal data connected with filling out the “Newsletter” form
Identity and contact details of the Data Controller
Samoa S.r.l., hereinafter also “Samoa” or “Data Controller” with registered address Via I° Maggio 9/11 – 31014 – Colle Umberto (TV), available at the e-mail address info@samoadivani.com, via the certified email (PEC) pec@pec.samoadivani.com or on +39 0438 433428.
Legal purpose and basis
A. Newsletter: contact information is used to send advertising or commercial material to the e-mail address provided.
B. Management of the manifestation and withdrawal of consent: the Data Controller processes personal data to confirm that consent to marketing communications requires double opt-in authorisation. The Data Controller records withdrawals of consent (blacklist) to ensure that no further communications are sent to those who do not wish to receive them.
C. Defensive purpose: the Data Controller may need to process personal data to manage complaints and out-of-court or court-based disputes.
| Purpose | Legal basis (common data) | Legal basis (specific data) |
|---|---|---|
| A. | Consent. | / |
| B. | Legitimate interest of the Data Controller to receive lawfully expressed consent and to trace withdrawals to avoid undesired communications. | / |
| C. | Legitimate interest of the Data Controller to ascertain, exercise or defend a right. | Ascertain, exercise or defend a right. |
Retention period
| Purpose | Retention period |
|---|---|
| A. | Until the withdrawal of consent. |
| B. | 1 month from data storage. Data stored on the blacklist is retained for 3 years. |
| C. | 10 years after the definitive finalisation of the dispute. |
Provision of data and consequences of refusal
| Purpose | Nature | Consequences |
|---|---|---|
| A. | Optional | It will not be possible to receive promotion and marketing communications. |
| B. | Optional | It will not be possible to receive promotion and marketing communications. |
| C. | Necessary | It will not be possible to manage the dispute. |
Scope of communication
Data is processed by internal staff authorised to carry out specific duties and communicated externally according to the following rules:
| Purpose | Categories of external recipients |
|---|---|
| A. | Marketing consultancy firms, companies that offer technology platform hosting/management services. |
| B. | Marketing consultancy firms, companies that offer technology platform hosting/management services. |
| C. | Law firms; Legal authorities. |
Since data is also processed with IT instruments, it may be visible to parties who carry out assistance/maintenance on said systems.
Transfer of data to third countries or international organisations
The Data Controller transfers personal data to third countries under the following conditions:
| Purpose | Country | Lawfulness of transfer |
|---|---|---|
| A. | United States of America |
|
| B. | ||
| C. |
Rights of the Data Subjects
Access: you can find out if your personal data is being processed, and if it is, obtain access to it and ask for a copy.
Rectification: you can ask for your personal data to be updated, corrected (if inaccurate) and to have incomplete data completed.
Erasure: you can have your personal data erased if certain conditions are met (please contact the Data Controller for further information).
Restriction: you can ask for your data to be tagged to limit processing in the future if certain conditions are met (please contact the Data Controller for further information).
Objection: you can object to the processing of your personal data for reasons connected to your own specific situation if the processing is based on legitimate interests or is necessary for the performance of a task carried out in the public interest or connected to the exercise of official authority vested in the Data Controller; you can also object to the processing of personal data for direct marketing purposes.
Portability: you can receive the personal data provided to the Data Controller in a structured format and ask to send it to another data controller if the processing is based on consent or on a contract and is carried out with automated methods.
Withdrawal of consent: you can withdraw consent for the purposes for which it was requested subject to the lawfulness of the processing carried out up to that time.
The actual rights that can be exercised with respect to the processing carried out are:
| Purpose | Access | Rectification | Erasure | Restriction | Objection | Portability | Withdrawal of consent |
|---|---|---|---|---|---|---|---|
| A. | X | X | X | X | X | X | |
| X | X | X | X | X | |||
| C. | X |
To exercise the above rights, it is possible to fill in the form available at https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/1089924 and send it to the following address: privacy@samoadivani.com. The data subject may make a request to the same address to obtain further details in relation to the information set out above (for example balancing test on the legitimate interests or the list of data processors).
You may also lodge a complaint with a supervisory authority: for Italy the Data Protection Supervisory Authority (www.garanteprivacy.it).