INFORMATION TO DATA SUBJECT CUSTOMER AND USER OF E-COMMERCE

This information to data subject concerns the data processing processed by Meteosolutions S.r.l., with headquarters in Via Don Carlo Botta, 13, Bergamo, postcode 20122, VAT number 03002650160, email address info@meteosolutions.com and mrivera@3bmeteo.com, telephone number 0354158611, hereinafter the “Data Controller”, in compliance with Regulation (EU) 2016/679 (hereinafter “GDPR”).

The Data Controller shall be process personal data related to customers or users, whether interested or contracting parties, as defined by the current legislation on personal data.

1. Identity and contact details of the data controller

The Data Controller is Meteosolutions S.r.l.

As the Data Controller is established in the Italian territory, no representative has been appointed.

2. Contact details of the data protection officer

The Data Controller has appointed a Data Protection Officer who may be contacted by the Data Controller address and also at the following address: dpo@meteosolutions.com

3. Third Party Data

If the customer and / or user were to communicate personal data of third party to the Data Controller, also for the performance of the contract, the customer and / or user must not only inform the third party of such circumstance, but also provide him with this Information to Data Subject. and make the present disclosure to the third party

4. Purposes of the processing and legal basis

The data subject’s data shall be processed for the following purposes:

a)      For contractual purposes and/or for purposes connected to the performance of pre-contractual measures adopted upon his or her specific request or anyhow connected to the performance of the order entered by the data subject as well as for the purpose of complying with legal obligations connected to the aforementioned purposes. In this case, the legit interest to process in order to perform the contract and/or to manage pre-contractual relationships shall provide the legal basis.

b)      To send direct marketing communications, newsletters, advertising and commercial material, through the use of traditional systems of contact and automated computer systems, including commercial or promotional communications by email or text message or for marketing survey. In this case, the data subject’s consent expressed in compliance with this information to data subject shall provide the legal basis;

c)      For profiling purposes and for the determination of the habits and preferences. In this case, the data subject’s consent expressed in compliance with this information to data subject shall provide the legal basis;

d)      For purposes connected to related legal obligations, whenever a data processing for the purposes of letter a) has been carried out. In this case, the legal obligation of the Data Controller to process such data according to the applicable national law shall provide the legal basis;

e)      The Data Controller, even without the expressed consent of the data subject, in light of the GDPR Considering 47 (direct-marketing purposes), may process the personal data provided by the data subject, in order to send communications regarding its own products and services, with rispect to those services or products that are similar to the ones already sold, unless the data subject explicitly object such processing.

5. Modalities of expressing consent

Consent, whenever requested, shall be given through the following means:

• By signing a digital document, also by clicking on a specific checkbox;
• By signing a paper document.

6. Modalities of treatment and logic

• In connection with the personal data processed and retained for the purposes referred to in point a), number 4 of this information on data subject (contractual and pre-contractual purposes), point d), number 4, (legal purposes), the processing will be carried out by way of paper means, automated means and through the use of CRM management software that allows to effectively manage the fulfilment of the contractual obligations;
• In relation to the personal data processed for the purposes referred to in point b), number 4 of this information to data subject (marketing purposes), the processing will be carried out through the use of software that automatically sends commercial information;
• In relazione ai dati personali trattati per le finalità di cui al punto c) numero 4 della presente informativa (finalità di determinazione di preferenze) il trattamento sarà effettuato mediante CRM che consentono di definire gusti e preferenze al fine di offrire servizi e comunicazioni personalizzate. Per ulteriori dettagli si veda il punto successivo;
• In relation to the personal data processed for the purposes referred to in point c), number 4 of this information to data subject (profiling purposes) the processing will be carried out through CRM that allows to define the likings and preferences in order to offer personalised services and communications;
• In relation to the personal data processed for the purposes referred to in point e), number 4 of this information to data subject (direct-marketing purposes), the processing will be carried out by way of paper means, automated means and through the use of CRM management.

7. Automated decision-making and profiling

If the data subject has given his or her consent to the processing of personal data for profiling purposes, the data may be subject to an automated decision-making process through a specific algorithm that will determine which communications are more suitable to his or her profile or which may be of more interest to him or her.

The processing carried out in such way shall have, as expected consequence, for example, the sending of highly profiled commercial communications, discounts, invitations to events deemed to be of interest, etc. In any case, the data subject shall have the right to obtain the human intervention in the Data Controller’s decision processing, to express his or her point of view, to obtain an explanation of the decision reached after such assessment and to challenge the decision.

8. The source of personal data

Only the data provided by the data subject, in compliance with this information to data subject, will be processed and collected at the Data Controller’s headquarter or by the send of an email of yours. Saranno trattati solo i dati forniti in conformità con la presente informativa, raccolti presso la nostra sede o mediante l’invio di email. In relation to the data processing carried out for profiling purposes, such data may be correlated in order to obtain further profiled information

9. Recipients and categories of recipients of personal data

Recipients of the data subject’s personal data may be:

• communication companies that carry out commercial communication and profiling activities on behalf of the Data Controller and are responsible for the processing;
• the companies that offer services of an information society, including, in particular, those offering hosting services;
• the companies that carry out statistical surveys, whenever you have expressed the related consent;
• auditing companies;
• companies and / or subjects belonging to Meteosolutions s.r.l. for the improvement of the quality of services offered and for marketing purposes of our services and / or updated information on products and services; natural and / or legal persons who, by virtue of contracts signed with Meteosolutions s.r.l., provide specific processing services or perform related, instrumental or support activities to those performed by Meteosolutions s.r.l.;
• to Meteosolutions s.r.l. consultants, within the limits necessary for carrying out their duties at Meteosolutions s.r.l. or to controlling companies, subsidiaries or associates of Meteosolutions s.r.l.;
  • to suppliers of goods and services within the necessary limits for carrying out the activities subject to the contractual relation
  • banking institutions for the management of receipts and payments;
  • financial administrations and other companies or public bodies in fulfilment of regulatory obligations;

10. Categories of data

The data subject’s personal data will be processed, also bank details and in any case all those data essential to correctly process the orders received and the refund procedure. In any case, no particular data may be processed (e.g. data that reveals the state of health).

11. Transfer of personal data

The Data Controller may intend to transfer personal data to a third country or to an international organisation. Such subjects may be:

• Communication companies that conduct communication activities on behalf of the Data Controller;
  • Service providers of the communication society;
  • Subsidiary or parent companies.

The transfer of personal data to the aforementioned subjects, if based in a third country or international organization, is carried out according to a decision of suitability of the European Commission, which evaluates how the third country, the territory or one or more specific sectors in the third country or the international organization ensure an adequate level of protection of the data subject’s rights. In the absence of such decision, the Data Controller – if deemed in any case appropriate – reserves himself the right to conclude specific separate agreements that oblige such subjects to adopt adequate security and also organizational measures, in order to offer appropriate guarantees related to the data subject’s rights.

The data may be transferred to the following countries: United States of America. In order to obtain a copy of such data or the place where they have been made available a request may be sent to the address set forth at the beginning of this document.

12. Personal data retention period

• The personal data processed and retained for the purposes referred to in point a), number 4 of this information to data subject (contractual and pre-contractual purposes) is processed, in the case of a concluded contract, for a period of time not exceeding 10 years from the termination of the effects of the contract and, in the case of mere pre-contractual negotiations, for a period not exceeding 10 years from the termination of the negotiations;
• The personal data processed for the purposes referred to in point b) and e) number 4 of this information to data subject (marketing purposes) are processed and retained until the data subject does not request the cancellation thereof;
• The personal data processed for the purposes referred to in point c), number 4 of this information to data subject (profiling purposes) are processed and retained for a period of time not exceeding 24 months from the collection of the data;
• The personal data processed and retained for the purposes referred to in point d), number 3 (fulfilment of legal obligations) are processed and retained, in the case of a concluded contract, for a period of time not exceeding 10 years from the termination of the effects of the contract, while, in the case of mere pre-contractual negotiations, for a period of time not exceeding 10 years from the termination of the negotiations.

13. Optional nature of the consent and consequences in case of lack of consent

• In relation to the personal data processed and retained for the purposes referred to in point a), number 4 of this information to data subject (contractual and pre-contractual purposes), the communication of personal data is both a contractual obligation and a necessary requirement for the performance of the pre-contractual negotiations and for the conclusion of the contract. The data subject has the right to provide personal data; however, in the event of failure to communicate such data, it will not be possible to conclude any contract or to perform any contractual negotiation;
• In relation to the personal data processed for the purposes referred to in point b), number 4 of this information to data subject (marketing purposes), the communication of personal data is not a contractual obligation. The data subject has the right to provide personal data; however, in the event of failure to communicate such data, no marketing activity shall be carried out;
• In relation to the personal data processed for the purposes referred to in point c), number 4 of this information to data subject (profiling purposes), the communication of personal data is not a contractual obligation. The data subject has the right to provide personal data; however, in the event of failure to communicate such data, no profiling activity shall be carried out;
• In relation to the personal data processed for the purposes referred to in point d), number 4 of this information to data subject (legal obligations), the communication of personal data is a legal obligation. In this case, the data subject is obliged to provide the personal data; in the event of failure to communicate such data, the contract shall not be concluded;
• In relation the personal data, processed for the purposes to in point e), number 4 of the current information to data processing (direct-marketing purposes) the communication of the personal data is not a contractual legal obligations requirement. The Data Controller may process the personal data provided by the data subject, in order to send communications regarding its own products and services, with rispect to those services or products that are similar to the ones already sold, unless the data subject explicitly object such processing.

14. Right to object

The data subject has the right to object as set out herein below:

• The right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her, according to point (e) or (f) of Article 6(1) of the GDPR, including profiling based on those provisions. The Data Controller shall no longer process the personal data unless the Data Controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims;
• Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing;
• Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes;
• Where personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1) of the GDPR, the data subject, on grounds relating to his or her particular situation, shall have the right to object to processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

15. Other rights

The Data Controller shall also inform the data subject about the existence of his or her following rights:

• Right of access by the data subject: the data subject shall have the right to obtain from the Data Controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and other specific information, pursuant to article 15 of the GDPR;
• Right to rectification: the data subject shall have the right to obtain from the Data Controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement, pursuant to article 16 of the GDPR;
• Right to data deletion, including the right to withdraw consensus: the person in question has the right to have his/her personal data deleted by the Holder without undue delay and the Holder is obliged to delete this personal data without undue delay, or to withdraw consensus, if the reasons defined in art. 17 of the GDPR are present. As far as the right to withdrawal is concerned, the person in question also has the right to withdraw consensus at any time without compromising the legitimacy of the handling based on the consensus presented prior to withdrawal;
  • Right of data handling limitation: the data subject shall have the right to obtain from the Data Controller restriction of processing where the grounds set out in article 18 of the GDPR apply;
  • Right to data portability: the data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to the Data controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another data controller without hindrance from the Data Controller to which the personal data have been provided under the conditions set out in article 20 of the GDPR;
  • Right to object to commercial communications: the data subject has the right to object, at any time, free of charges, on receipt of commercial communications.

16. Rights exercise

The request to exercise the rights outlined in this information to data subject must be addressed directly to the Data Controller at the email address info@meteosolutions.com. Alternatively, such rights may be exercised by sending a letter to such effect by registered post with acknowledgement of receipt to the address via Don Carlo Botta, 13 – Bergamo (Bg).

17. Accessibility to information to data subject

The information to data subject is made available at the following address info@meteosolutions.com, as well as at the Data Controller’s headquarter. If expressly requested by the data subject, the information may also be orally provided, provided that identity of the data subject is proven, by means of a telephone call.

18. Amendments

The Data Controller may make changes to this information to data subject, also in order to incorporate changes in national and/or EU legislation, to adapt to technological innovations or for other reasons. Any new version of this information to data subject will be made available on Meteomed website. The data subject is therefore invited to periodically check the information to data subject. Any modification will be communicated to data subject by means of pop-ups/banner on the website or by means of any other different method / IT tool.

Last updated: April 2023