A- Data controller
B-Personal and navigation data
1-What personal data we collect and why we collect it
In order to offer you the services provided by its websites K-MYDA S.r.l. (hereinafter KMYDA), as the Data Controller, must process certain personal data necessary for the provision of services.
This data may be implicitly provided through the tools you use to access and use the services or may be provided by you directly.
KMYDA may process the following categories of users' personal data:
• technical navigation data relating to the IP address, the identification codes of the devices employed by the user for usage of the site or services, the characteristics of the browser and access times;
• navigation data for profiling purposes provided indirectly through the use of the service itself and obtained and analysed with the user's consent;
• common identification data provided by the user (e.g. name, surname, email, telephone number, etc.) for the use of products and services;
2-Purpose and legal bases of the processing
Your personal data will be processed by KMYDA exclusively for the purpose of providing the services you have requested or subscribed to (contractual purposes) and for the further purposes for which you have given your consent.
In particular, your data will be used by KMYDA to allow you to register on the site, use all the services offered through the site and join the KMYDA Community.
Following your initial registration, which constitutes a necessary condition for the provision of the service you have requested, when requesting the use of further services, you will be able to use the credentials (username / email / password) already used during the first registration.
Only with your express consent will the data be used for statistical analysis, market surveys, promotional activities via social media and sending commercial information about KMYDA's products and promotional initiatives. (Direct marketing purposes).
Always with your consent, your information relating to the history of your purchases, sales or participation in auctions and/or showcases may be used for profiling purposes (creation of individual and group profiles). This data processing activity involves the analysis of your user or customer profile to determine your preferences. For example, based on your purchase or sales history, we will offer you products that we think you may be interested in. (Profiling Purposes)
Finally, with your express consent, your data may be provided to other companies operating in the publishing, financial, automotive insurance, energy, consumer goods, humanitarian and charitable organizations who may contact you as Controllers of autonomous initiatives. The updated list is at your disposal and may be requested from the Data Controller at the above addresses - for statistical analysis, market surveys and sending commercial information on products and promotional initiatives. (Marketing purposes by third parties)
Communications for market surveys or commercial information on products and promotional initiatives may be made by post, e-mail, telemarketing, text messages or mms.
We would like to inform you that some activities could be carried out through suppliers, specifically appointed as Data Processors, including entities residing outside the European Union.
The legal bases of the purposes described above concern the execution of your request as the interested party and the consent you have given.
3-Disclosure, communication and data access subjects
Your personal data will not be disclosed, but may be communicated where necessary for the provision of the service to third parties (such as third party technical service providers, postal couriers, hosting providers, IT companies) appointed, if necessary, as Data Processors by K-MYDA for technical or organizational tasks instrumental to the provision of services.
Access to the data is also granted to categories of K-MYDA employees involved in the data processing organization (administrative, sales, marketing, customer service, system administrators).
The updated list of Managers can always be requested from the Data Controller.
This is without prejudice to the right of communication to third parties if you have given your relative specific and optional consent.
4-Transfer of data abroad
Your personal data will be processed by KMYDA within the territory of the European Union.
If, for technical and/or operational reasons, it is necessary to make use of entities located outside the European Union, or transfer some of the data collected to technical systems and services managed in the cloud and located outside the European Union, the processing will be governed by the provisions of Chapter V of the Regulation and authorized according to specific decisions of the European Union. Therefore, all necessary precautions will be taken in order to ensure the fullest protection of personal data by basing such transfer: a) on decisions of adequacy of the recipient third countries expressed by the European Commission; b) on adequate guarantees expressed by the recipient third party pursuant to art. 46 of the Regulation; c) on the adoption of binding corporate rules, the “Corporate binding rules”.
5-Time during which personal data is processed and stored
In accordance with Art. 5.1 e) of the GDPR, KMYDA will process the data provided by you for the entire duration of the services requested and will keep them for the following 6 months for the completion of the administrative activities, as well as for the time necessary to fulfil legal obligations and for the protection of the action.
6 - Rights of the interested party
KMYDA guarantees that you can exercise your rights under Article 12 of the GDPR at any time. In particular, you are entitled to:
- know whether the Controller holds and/or processes personal data relating to your person and have full access to it, including by obtaining a copy (art. 15 Right of access);
- rectify inaccurate personal data or integrate incomplete personal data (Art. 16 Right to rectification);
- erase personal data held by the Data Controller if one of the reasons provided for by the GDPR applies (Art. 17 Right to Erasure);
- request the Controller to limit the processing only to certain personal data, if one of the reasons provided for by the GDPR applies (Art. 18 Right to restriction of processing);
- request and receive all your personal data processed by the controller, in a commonly used, structured format that is readable by automatic device or request transmission to another controller without restriction (Art. 20 Right to Data Portability);
- oppose in whole or in part to the processing of data for the purpose of sending advertising material and market research (so called Consent) (Art. 21 Right to object)
- oppose in whole or in part to the processing of data in automatic or semi-automatic mode for profiling purposes (so called Consent).
- withdraw the consent given at any time, but without prejudice to the lawfulness of the processing based on the consent given
prior to the withdrawal (art. 7 par. 3 Withdrawal of consent);
These rights may be exercised by notifying the Data Controller whose contact details are indicated above.
In addition, you are always entitled to lodge a complaint with the Supervisory Authority for the Protection of Personal Data, which can be contacted at https://www.garanteprivacy.it/
7 - Optional provision of data