Updated on 2023-09-22

WEBSITE PRIVACY NOTICE PURSUANT TO ARTICLES 13 AND 14 OF EUROPEAN REGULATION 2016/679 (GDPR)

This notice is made available in your capacity as Data Controller by Stone Italiana S.p.A, as Data Controller of your personal data pursuant to and for the purposes of Articles 13 and 14 of European Regulation 2016/679. We inform you that the aforementioned legislation provides for the protection of data subjects with respect to the processing of personal data and that such processing will be based on the principles of fairness, lawfulness, and transparency and the protection of your privacy and your rights. The information and personal data you provide or otherwise acquired in connection with the use of the site will be processed in accordance with the legislative provisions of the aforementioned regulations and the confidentiality obligations provided therein.

DATA SUBJECTS AND RETENTION PERIOD

A) Users (visitors) of the website www.cosmolite.com and the App for iOS and Android

Specific summary notices are progressively reported or displayed on the pages of the site prepared for particular services upon request that include forms for data collection. We also inform you that, to provide a complete service, our site may contain links to other websites not managed by Stone Italiana S.p.A. Stone Italiana S.p.A. is not responsible for errors, content, cookies, publications of unlawful moral content, advertising, banners, or files not compliant with current regulatory provisions and compliance with Privacy regulations by sites not managed by the Data Controller.

Types of data processed

• Navigation Data: IP addresses or domain names of computers and other devices used by users who connect to the site; addresses in URI (Uniform Resource Identifier) notation of the requested resources and any time indications thereof; parameters relating to the operating system and the user’s IT environment; departure and arrival pages; navigation index and identifying behaviors during viewing of the site pages.
• Personal data voluntarily provided by the user: the optional, explicit, and voluntary sending of email to the addresses indicated on this site and the completion of forms on the same entails the subsequent acquisition of the sender’s personal data (by way of example only: name, surname, email address). Specific summary notices are present on the pages that include the forms.

Purpose of processing: your data collected during navigation will be processed for the following purposes.

1. performance of operations strictly connected and instrumental to the management of relationships with users or visitors to the site or Apps;
2. collection, storage, and processing of your data for statistical analysis, including in anonymous and/or aggregated form; statistical analysis aimed at verifying the quality of services offered by the site;
3. sharing with social network operators the interactions made and Usage Data relating to pages on which cookies are installed that integrate software products or functions
4. improving the browsing experience in order to send services and advertising messages in line with preferences expressed during navigation

The processing of data for the performance of the purpose referred to in point 1 is necessary to fulfill your request and any refusal could limit and/or prevent full use of the features and services on the site. The legal basis for processing your data for the purposes referred to in point 1 is the fulfillment of your request, pursuant to Article 6.1.b) of the GDPR; your refusal to provide such data would make it impossible to consult the Site.
The provision of data indicated in purposes 2, 3, and 4 is optional on the legal basis of consent, and any refusal to process does not compromise the features and services on the site. The legal basis for processing your data for the purposes referred to in points 2, 3, and 4 is optional, pursuant to Article 6.1.a). Consent is given through the brief notice by clicking on the word “ACCEPT COOKIES” in the brief notice. Regarding optional provision, further information relating to cookies on the site is provided in the cookie policy document also accessible from the brief notice.

Navigation data is stored for the times indicated in the cookie policy available on the site.

B) Users of the contact us section
By completing the forms accessible in the “Contact Us” section, your data (name, surname, email address, city) will be used to respond to your request for information. The provision of data for such purposes is the fulfillment of your request. The legal basis for processing is Article 6.1.b) of the GDPR.
Your data, subject to your consent given by selecting the appropriate marketing box, will be used to send commercial and advertising information concerning informational messages and commercial and promotional communications relating to the activities and products of Stone Italiana S.p.A through traditional methods (e.g., telephone contact, individual emails, etc.) or automated contact methods (e.g., automated email campaigns, social networks, etc.), software systems managed by third parties, including through their inclusion in the Data Controller’s company CRM in full compliance with the principles of lawfulness and fairness and legal provisions. The provision of your data for this purpose is optional and does not compromise the response to your request for information. The legal basis for processing is Article 6.1.a) of the GDPR. At any time you may object to the processing using the link at the bottom of the email or by sending a request to the Data Controller at the contact details indicated in this notice.
Your data will be stored for the time necessary to provide the service you requested and for marketing purposes until you decide to cancel your subscription or object to the processing.
C) Warranty certificate request users
By completing the forms accessible in the “Warranty Certificate” section, your data (name, surname, email address, city) will be used to respond to your request for information. The provision of data for such purposes is the fulfillment of your request. The legal basis for processing is Article 6.1.b) of the GDPR.
Your data, subject to your consent given by selecting the appropriate marketing box, will be used to send commercial and advertising information concerning informational messages and commercial and promotional communications relating to the activities and products of Stone Italiana S.p.A through traditional methods (e.g., telephone contact, individual emails, etc.) or automated contact methods (e.g., automated email campaigns, social networks, etc.), software systems managed by third parties, including through their inclusion in the Data Controller’s company CRM in full compliance with the principles of lawfulness and fairness and legal provisions. The provision of your data for this purpose is optional and does not compromise the response to your request for information. The legal basis for processing is Article 6.1.a) of the GDPR. At any time you may object to the processing using the link at the bottom of the email or by sending a request to the Data Controller at the contact details indicated in this notice.
Your data will be stored for the time necessary to provide the service you requested and for marketing purposes until you decide to cancel your subscription or object to the processing.

D) Sending communications to the company

The Company processes the user’s personal data in relation to the optional, explicit, and voluntary sending by the user in relation to sending email, certified email, and/or ordinary mail sent to the Company’s contact details possibly also reported on the website. In particular, personal and contact data will be processed, in addition to content sent by the user, through voicemail, multimedia tools, social networks, WhatsApp, and other comparable applications.

The purpose is to allow data subjects to communicate with the Company.
The legal basis for processing is the performance of a contract.
Depending on the subject and type of messages, the time required to respond to the data subject’s requests may vary. In any case, the retention time cannot exceed 10 years.
Provision is mandatory to initiate a relationship.

E) Job opportunities

The Company collects data from subjects interested in submitting their application for positions within the company. The Company processes the curriculum vitae, identification, and contact data necessary to evaluate the request and contact the candidate if the profile is of interest.
Data may be collected either following the sending of spontaneous applications by letter or email, or through online application features.
The purpose of processing is the management of the application and performance of personnel research and selection activities, based on the possible establishment of a collaborative relationship.
The legal basis for processing is the performance of a contract.
Data is stored for a maximum of 24 months from provision.
Provision is mandatory for evaluation of the application.

F) Processing of customer and supplier data

The company processes the personal data of customers and suppliers to:

• conclude contractual/professional relationships;
• fulfill pre-contractual, contractual, and tax obligations arising from existing relationships, as well as manage the necessary communications connected to them;
• fulfill obligations required by law, regulation, EU legislation, or an order from the Authority;

The purpose is the performance of the contract with the customer/supplier and management of administrative and accounting obligations.
The legal basis for processing is the contract entered into between the Company and the customer/supplier.
Data is stored for the entire duration of the contract and for a maximum of 10 years from its conclusion, for assessment obligations.
Provision is mandatory for contract performance.

F) Newsletter service

The newsletter periodically offers a selection of news about our products, company updates, or other information. The newsletter may include advertising from commercial partners of the Group.

The purposes are the provision of the editorial newsletter service and informing the user about the Data Controller’s services, products, promotions, and events and those of its commercial partners; anonymous and aggregated analysis tools for the performance of each marketing campaign may be used.
The legal basis for processing may be, depending on the case, the agreement between the data controller and the subscriber to the service or the user’s consent, provided for example during site registration or when registering for events or initiatives.

Retention period: data is stored for the entire duration of the service, until cancellation.

Provision: mandatory, but only to receive the newsletter.

METHODS OF PROCESSING PERSONAL DATA
Your personal data will be processed manually, electronically, and/or remotely, through the use of cookies (as indicated in the cookie policy available on the site) by means of electronic computers using third-party software and automated contact methods (e.g., automated email campaigns, SMS, automated telephone contact, instant messaging, social networks, etc.), in compliance with the methods referred to in Articles 6 and 32 of the GDPR and through the adoption of adequate security measures provided.
The Data Controller, to compare and possibly improve the results of communications, uses systems for sending newsletters and promotional communications with reports. Thanks to the reports, the Data Controller will be able to know, for example: the number of readers, openings, unique “clickers” and clicks; devices (iPhone, Blackberry, Nokia…) and operating systems (Windows, Apple, Linux, Android…) used to read the communication; details on the activity of individual users; details of emails sent by date/time/minute; details of emails delivered and not delivered, and those forwarded; list of newsletter unsubscribers; who opened an email or clicked a single link; users with message display problems; link tracking (i.e., the number of clicks made on message links); click tracking (which links were clicked and by whom). All this data is used to compare and possibly improve communication results.

USE OF SOCIAL PLATFORMS
Stone Italiana S.p.A may also provide links to other social media platforms that lead to servers installed by individuals or organizations over which it has no control. Stone Italiana S.p.A makes no representation and assumes no responsibility regarding the accuracy or any other aspect of information available on such sites. A link to a third-party site cannot be construed as validation, either by Stone Italiana S.p.A or by such third party, of the products and services of others or such third party. Stone Italiana S.p.A makes no statements or warranties regarding the use or storage of user data on third-party sites. Users are invited to carefully examine the privacy policy governing third-party sites linked to our website to have a complete view of the possible use of your personal data.

RECIPIENTS OF PERSONAL DATA AND DATA DISCLOSURE
Your data will be processed by appropriately authorized personnel and will be communicated externally to companies acting as independent Data Controllers or Data Processors:

• external service providers;
• technical assistance service providers;

The complete list can be requested by writing to the Data Controller’s contact details.

TRANSFER OF PERSONAL DATA
Your data is transferred to countries outside the European Union as indicated in the Cookie Policy of the companies that provide services relating to third-party cookies. For more information, write to stone@stoneitaliana.com

For sending corporate communications, your data is transferred to countries within the European Union: such transfer is in any case lawful as it is guaranteed by the existence of adequacy decisions issued by the European Commission. You may request from the Data Controller a copy of the safeguards adopted for the EU transfer of your personal data, as well as information on the places where they have been made available, by submitting a specific request to the Data Controller via email at stone@stoneitaliana.com

MINORS
The Site is not intended for use by minors under 14 years of age and no data of minors under 14 years of age is collected by the Data Controller.
In the event that the Data Controller becomes aware of the collection of such data (e.g., through the contact form), it will delete it immediately. The Firm will respond to requests for information in accordance with applicable laws.
Please note that the person exercising parental responsibility is required, in the case of requests for information, to provide us with consent to the collection of the minor’s personal data.

DATA CONTROLLER
The Data Controller is Stone Italiana S.p.A, with registered office at Via Lavagno, 213 37040 Zimella (Verona) – 0442 715715 stone@stoneitaliana.com in the person of the pro-tempore legal representative.
You have the right to obtain from the Data Controller the erasure (right to be forgotten), restriction, updating, rectification, portability, and objection to the processing of personal data concerning you, as well as in general to exercise all the rights provided for by Articles 15 and following of European Regulation 2016/679 by writing to stone@stoneitaliana.com. The data subject has the right to lodge a complaint with the supervisory Authority.

APPLICATION OF THIS NOTICE
If you have questions regarding this Notice, first contact Stone Italiana S.p.A by sending an email to stone@stoneitaliana.com or by contacting the Data Controller at the company contact details provided in this document.

CHANGES TO THIS NOTICE
Stone Italiana S.p.A reserves the right to update this notice to adapt it to supervening law, as well as taking due consideration of suggestions transmitted by employees, customers, collaborators, and users. In the event of changes by Stone Italiana S.p.A, the Privacy Notice on the main privacy page and on the Homepage of the website https://cosmolite.com/ will be promptly updated.

RIGHTS OF DATA SUBJECTS

EU Regulation 2016/679: Articles 15, 16, 17, 18, 19, 20, 21, 22 – Rights of the Data Subject

1. The data subject has the right to obtain confirmation of the existence or otherwise of personal data concerning them, even if not yet recorded, and their communication in intelligible form and the possibility of lodging a complaint with the supervisory Authority.

2. The data subject has the right to obtain indication of:

• the origin of the personal data;
• the purposes and methods of processing;
• the logic applied in the case of processing carried out with the aid of electronic tools;
• the identifying details of the controller, processors, and the representative designated pursuant to Article 5, paragraph 2;
• the subjects or categories of subjects to whom the personal data may be communicated or who may become aware of it as a designated representative in the territory of the State, as processors, or as personnel authorized to process personal data.

3. The data subject has the right to obtain:

• updating, rectification, or, when interested, integration of the data;
• erasure, transformation into anonymous form, or blocking of data processed in violation of the law, including data whose retention is unnecessary in relation to the purposes for which the data was collected or subsequently processed;
• certification that the operations referred to in letters a) and b) have been brought to the attention, also with regard to their content, of those to whom the data has been communicated or disclosed, except where this requirement proves impossible or involves the use of means manifestly disproportionate to the protected right;
• data portability.

4. The data subject has the right to object, in whole or in part:

• on legitimate grounds to the processing of personal data concerning them, even if pertinent to the purpose of collection;
• to the processing of personal data concerning them for the purpose of sending advertising material or direct selling or for carrying out market research or commercial communication