Newsletter Form Data Policy

This policy supplements the website use policy with the aim of illustrating in detail how the Data Controller will process the data collected via this form. For that reason, users are asked to read the website use policy.

Identity and contact data of the Data Controller

Calzaturificio S.C.A.R.P.A. S.P.A., henceforth “SCARPA” or “Data Controller”, with head offices at 1 Via Enrico Fermi, Asolo (TV) 31011, which can be contacted via email at info@scarpa.net, and certified email (PEC) at calzaturificioscarpaspa@legalmail.it or via telephone at +39 0423 5284.

 
Purpose and legal basis

A. Newsletter: contact information is used to send periodical communications about the company’s products or services, promotions and invitations to events which the Data Controller is participating in.
 
B. Social Media Marketing: the contact data are communicated to digital platform providers that allow the Data Controller to reach a look-alike audience, meaning individuals with characteristics and interests analogous to those of the data subject.
 
C. Legal defence: the Data Controller may need to process personal data for the management of disputes and litigation, in or out of court. 

 

 

Purpose	Legal basis (general data)	Legal basis (specific data)
A.	Fulfilment of the Data Subject's request for the service.	/
B.	Legitimate interest in promoting awareness of its products and services also to other individuals who may have interests similar to those of the data subject.	/
C.	Legitimate interest of the Data Controller to establish, exercise or defend a right	Establish, exercise or defend a right.

 

 

Storage periods

 

Purpose	Duration of storage
A.	Until consent is withdrawn.
B.	Until the right to object is exercised.
C.	10 years from the definitive resolution of the dispute.

 

Nature of the data transfer and consequences of refusal

 

Purpose	Nature	Consequences
A.	Optional	24 months from notification, regardless of the communication channel used.
B.	Optional	Inability for the Data Controller to reach a look-alike audience.
C.	Necessary	Inability to manage disputes.

 

 

Scope of disclosure

Data are processed by internal staff members who have been authorized to carry out specific tasks, and shared externally according to the following rules

  

 

Purpose	External recipient categories
A.	External consultants, companies which offer technological platform hosting/management services.
B.	Companies that operate digital platforms such as Google and Meta.
C.	Law firms; Judicial authorities.

 

 

Because data are processed with methods that include the use of computerized tools, they may also be accessed by individuals who provide assistance/maintenance for said systems.

 

 

 

Data transfers to third countries or international organizations

The Data Controller transfers personal data to the countries listed below, under the following conditions:

 

Purpose		Country	Lawfulness of the transfer derives from
A.	United States of America		·           Data Privacy Framework ·           Standard Contractual Clauses
B.	United States of America		·           Data Privacy Framework ·           Standard Contractual Clauses
C.

 

 

Rights of the Data Subject

The individual to whom the personal data refers to has the following rights: 

Access: data subjects can find out whether or not their personal data are being processed and, when that is the case, access the personal data and obtain a copy.
Rectification: the data subject can request that their personal data be updated, corrected (if inaccurate) and completed (if incomplete).
Erasure: data subjects can obtain the erasure of their personal data when certain conditions are met (for more information, contact the Data Controller).
Restriction: data subjects can request that their data are marked so as to limit their future processing, when certain conditions are met (for more information, contact the Data Controller).
Objection: it is possible, on grounds relating to one’s individual situation, to object to the processing of personal data when said processing is necessary for the purposes of legitimate interests or for the completion of a task in the public interest or connected to the exercise of public powers vested in the Data Controller. Moreover, it is possible to object to the processing of personal data for direct marketing purposes.
Portability: data subjects can receive, in a structured format, the personal data provided to the Data Controller and request that said data be transmitted to another data controller when the processing is based on consent or on a contract and is carried out by automated means.
Withdrawal of consent: it is possible to withdraw consent for the purposes for which it was requested, without prejudice to the lawfulness of the processing carried out before withdrawal.