Updated on September 22, 2023

WEBSITE PRIVACY NOTICE PURSUANT TO ARTICLES 13 AND 14 OF EUROPEAN REGULATION 2016/679 (GDPR)

This notice is provided to you in your capacity as Data Controller by Stone Italiana S.p.A., as the Data Controller of your personal data, pursuant to and for the purposes of Articles 13 and 14 of European Regulation 2016/679. We inform you that the aforementioned legislation provides for the protection of data subjects with respect to the processing of personal data and that such processing will be based on the principles of fairness, lawfulness, and transparency, as well as the protection of your privacy and your rights. The information and personal data you provide or that are otherwise collected in connection with your use of the site will be processed in accordance with the provisions of the aforementioned regulations and the confidentiality obligations set forth therein.

DATA SUBJECTS AND RETENTION PERIOD

A) Users (visitors) of the website www.cosmolite.com and the app for iOS and Android

Specific summary notices are progressively posted or displayed on the pages of the website dedicated to particular services upon request, which include forms for data collection. We also inform you that, in order to provide a comprehensive service, our website may contain links to other websites not managed by Stone Italiana S.p.A. Stone Italiana S.p.A. is not responsible for errors, content, cookies, the publication of content that violates moral standards, advertising, banners, or files that do not comply with current regulatory provisions and privacy regulations on websites not managed by the Data Controller.

Types of Data Processed

• Navigation Data: IP addresses or domain names of computers and other devices used by users who connect to the site; addresses in URI (Uniform Resource Identifier) notation of the requested resources and any associated timestamps; parameters relating to the operating system and the user’s IT environment; entry and exit pages; navigation index and identifying behaviors while viewing the site’s pages.
• Personal data voluntarily provided by the user: the optional, explicit, and voluntary sending of emails to the addresses listed on this site and the completion of forms on this site result in the subsequent collection of the sender’s personal data (for example: first name, last name, email address). Specific privacy notices are provided on the pages containing the forms.

Purpose of processing: Your data collected while browsing will be processed for the following purposes.

1. the performance of operations that are strictly connected to and essential for managing relationships with users or visitors to the website or apps;
2. collection, storage, and processing of your data for statistical analysis, including in anonymous and/or aggregated form; statistical analysis aimed at verifying the quality of the services offered by the site;
3. sharing with social network operators the interactions that have taken place and usage data related to pages on which cookies are installed that integrate software products or functions
4. improving the browsing experience in order to provide services and advertising messages tailored to the preferences expressed while browsing

The processing of data for the purpose referred to in point 1 is necessary to fulfill your request, and any refusal could limit and/or prevent your full use of the features and services on the site. The legal basis for processing your data for the purposes referred to in point 1 is the fulfillment of your request, pursuant to Article 6.1.b) of the GDPR; your refusal to provide such data would make it impossible to access the Site.
The provision of data indicated in purposes 2, 3, and 4 is optional on the legal basis of consent, and any refusal to consent to processing does not affect the features and services on the site. The legal basis for processing your data for the purposes referred to in points 2, 3, and 4 is consent, pursuant to Article 6.1.a). Consent is given by clicking on the word “ACCEPT COOKIES” in the pop-up notice. Regarding optional provision, further information regarding cookies on the site is provided in the cookie policy document, which is also accessible from the pop-up notice.

Navigation data is stored for the periods specified in the cookie policy available on the site.

B) Users of the “Contact Us” section
By filling out the forms available in the “Contact Us” section, your data (first name, last name, email address, city) will be used to respond to your request for information. The provision of data for these purposes is necessary to fulfill your request. The legal basis for processing is Article 6(1)(b) of the GDPR.
Your data, subject to your consent given by selecting the appropriate marketing checkbox, will be used to send commercial and advertising information, including informational messages and commercial and promotional communications relating to the activities and products of Stone Italiana S.p.A., through traditional methods (e.g., telephone contact, individual emails, etc.) or automated contact methods (e.g., automated email campaigns, social media, etc.), as well as through software systems managed by third parties, including by including your data in the Data Controller’s corporate CRM, in full compliance with the principles of lawfulness and fairness and applicable legal provisions. Providing your data for this purpose is optional and does not affect the response to your request for information. The legal basis for processing is Article 6.1.a) of the GDPR. You may object to the processing at any time by using the link at the bottom of the email or by sending a request to the Data Controller at the contact details indicated in this notice.
Your data will be stored for the time necessary to provide the service you requested and for marketing purposes until you decide to cancel your subscription or object to the processing.
C) Users requesting a warranty certificate
By completing the forms available in the “Warranty Certificate” section, your data (first name, last name, email address, city) will be used to respond to your request for information. Providing data for these purposes is necessary to fulfill your request. The legal basis for processing is Article 6.1.b) of the GDPR.
Your data, subject to your consent given by selecting the appropriate marketing checkbox, will be used to send commercial and advertising information, including informational messages and commercial and promotional communications regarding the activities and products of Stone Italiana S.p.A., through traditional methods (e.g., telephone contact, individual emails, etc.) or automated contact methods (e.g., automated email campaigns, social media, etc.), software systems managed by third parties, including through their inclusion in the Data Controller’s corporate CRM, in full compliance with the principles of lawfulness and fairness and applicable legal provisions. The provision of your data for this purpose is optional and does not affect the response to your request for information. The legal basis for processing is Article 6(1)(a) of the GDPR. You may object to the processing at any time by using the link at the bottom of the email or by sending a request to the Data Controller at the contact details indicated in this notice.
Your data will be stored for the time necessary to provide the service you requested and for marketing purposes until you decide to cancel your subscription or object to the processing.

D) Sending communications to the company

The Company processes the user’s personal data in connection with the optional, explicit, and voluntary submission by the user of emails, certified emails, and/or regular mail sent to the Company’s contact information, which may also be listed on the website. In particular, personal and contact data will be processed, in addition to content sent by the user via voicemail, multimedia tools, social networks, WhatsApp, and other similar applications.

The purpose is to allow data subjects to communicate with the Company.
The legal basis for processing is the performance of a contract.
Depending on the subject and type of messages, the time required to respond to the data subject’s requests may vary. In any case, the retention period cannot exceed 10 years.
Providing this information is mandatory to establish a relationship.

E) Job Opportunities

The Company collects data from individuals interested in applying for positions within the company. The Company processes the resumes, identification, and contact information necessary to evaluate the application and contact the candidate if the profile is of interest.
Data may be collected either through unsolicited applications sent by mail or email, or through online application forms.
The purpose of processing is to manage the application and conduct personnel recruitment and selection activities, with a view to potentially establishing an employment relationship.
The legal basis for processing is the performance of a contract.
Data is stored for a maximum of 24 months from the date of provision.
Provision of data is mandatory for the evaluation of the application.

F) Processing of Customer and Supplier Data

The company processes the personal data of customers and suppliers in order to:

• enters into contractual or professional relationships;
• fulfill pre-contractual, contractual, and tax obligations arising from existing relationships, as well as manage the necessary communications related to them;
• to fulfill obligations required by law, regulation, EU legislation, or an order from the Authority;

The purpose is to fulfill the contract with the customer/supplier and to manage administrative and accounting obligations.
The legal basis for processing is the contract entered into between the Company and the customer/supplier.
Data is stored for the entire duration of the contract and for a maximum of 10 years from its conclusion, to meet audit requirements.
Provision of data is mandatory for the performance of the contract.

F) Newsletter Service

The newsletter periodically features a selection of news about our products, company updates, or other information. The newsletter may include advertisements from the Group's commercial partners.

The purposes include providing the editorial newsletter service and informing users about the Data Controller’s services, products, promotions, and events, as well as those of its business partners; anonymous and aggregated analysis tools may be used to evaluate the performance of each marketing campaign.
The legal basis for processing may be, depending on the case, the agreement between the data controller and the service subscriber or the user’s consent, provided, for example, during website registration or when registering for events or initiatives.

Retention period: Data is stored for the entire duration of the service, until cancellation.

Requirement: mandatory, but only to receive the newsletter.

METHODS OF PROCESSING PERSONAL DATA
Your personal data will be processed manually, electronically, and/or remotely, through the use of cookies (as indicated in the cookie policy available on the site) by means of electronic computers using third-party software and automated contact methods (e.g., automated email campaigns, SMS, automated telephone contact, instant messaging, social networks, etc.), in compliance with the methods referred to in Articles 6 and 32 of the GDPR and through the adoption of adequate security measures.
The Data Controller, to analyze and potentially improve the results of communications, uses systems for sending newsletters and promotional communications that generate reports. Thanks to these reports, the Data Controller will be able to determine, for example: the number of readers, opens, unique “clickers,” and clicks; devices (iPhone, BlackBerry, Nokia, etc.) and operating systems (Windows, Apple, Linux, Android, etc.) used to read the communication; details on the activity of individual users; details of emails sent by date, time, and minute; details of delivered and undelivered emails, as well as those forwarded; a list of newsletter unsubscribers; who opened an email or clicked a specific link; users experiencing message display issues; link tracking (i.e., the number of clicks on links in the message); click tracking (which links were clicked and by whom). All this data is used to compare and potentially improve communication results.

USE OF SOCIAL MEDIA PLATFORMS
Stone Italiana S.p.A. may also provide links to other social media platforms that lead to servers operated by individuals or organizations over which it has no control. Stone Italiana S.p.A. makes no representations and assumes no responsibility regarding the accuracy or any other aspect of the information available on such sites. A link to a third-party site cannot be construed as an endorsement, either by Stone Italiana S.p.A. or by such third party, of the products and services of others or of such third party. Stone Italiana S.p.A. makes no statements or warranties regarding the use or storage of user data on third-party sites. Users are encouraged to carefully review the privacy policies governing third-party sites linked to our website to gain a complete understanding of how their personal data may be used.

RECIPIENTS OF PERSONAL DATA AND DATA DISCLOSURE
Your data will be processed by appropriately authorized personnel and will be disclosed to third-party companies acting as independent Data Controllers or Data Processors:

• external service providers;
• technical assistance service providers;

The complete list can be requested by contacting the Data Controller at the provided address.

TRANSFER OF PERSONAL DATA
Your data is transferred to countries outside the European Union as indicated in the Cookie Policy of the companies that provide services related to third-party cookies. For more information, please contact stone@stoneitaliana.com

For the purpose of sending corporate communications, your data is transferred to countries within the European Union: such transfer is lawful in any case, as it is guaranteed by the existence of adequacy decisions issued by the European Commission. You may request from the Data Controller a copy of the safeguards adopted for the transfer of your personal data to the EU, as well as information on where they have been made available, by submitting a specific request to the Data Controller via email at stone@stoneitaliana.com

MINORS
The Site is not intended for use by minors under 14 years of age, and the Data Controller does not collect any data from minors under 14 years of age.
If the Data Controller becomes aware that such data has been collected (e.g., through the contact form), it will delete it immediately. The Firm will respond to requests for information in accordance with applicable laws.
Please note that the person exercising parental responsibility is required, in the case of requests for information, to provide us with consent to the collection of the minor’s personal data.

DATA CONTROLLER
The Data Controller is Stone Italiana S.p.A., with registered office at Via Lavagno, 213, 37040 Zimella (Verona) – 0442 715715, stone@stoneitaliana.com, represented by its current legal representative.
You have the right to request from the Data Controller the erasure (right to be forgotten), restriction, updating, rectification, portability, and objection to the processing of personal data concerning you, as well as, in general, to exercise all the rights provided for in Articles 15 and following of European Regulation 2016/679 by writing to stone@stoneitaliana.com. The data subject has the right to lodge a complaint with the supervisory authority.

APPLICATION OF THIS NOTICE
. If you have questions regarding this Notice, please first contact Stone Italiana S.p.A. by sending an email to stone@stoneitaliana.com or by contacting the Data Controller using the company contact information provided in this document.

CHANGES TO THIS NOTICE
, Stone Italiana S.p.A. reserves the right to update this notice to bring it into compliance with new laws, as well as to take into account suggestions submitted by employees, customers, partners, and users. In the event of changes made by Stone Italiana S.p.A., the Privacy Notice on the main privacy page and on the homepage of the website https://cosmolite.com/ will be updated promptly.

RIGHTS OF DATA SUBJECTS

EU Regulation 2016/679: Articles 15, 16, 17, 18, 19, 20, 21, 22 – Rights of the Data Subject

1. The data subject has the right to obtain confirmation as to whether or not personal data concerning them exists—even if it has not yet been recorded—and to have such data communicated to them in an intelligible form, as well as the right to file a complaint with the supervisory authority.

2. The data subject has the right to obtain information regarding:

• the origin of the personal data;
• the purposes and methods of processing;
• the logic applied in the case of processing carried out using electronic means;
• the identifying details of the controller, processors, and the representative designated pursuant to Article 5, paragraph 2;
• the individuals or categories of individuals to whom the personal data may be disclosed or who may become aware of it in their capacity as designated representatives within the territory of the State, as data processors, or as personnel authorized to process personal data.

3. The data subject has the right to obtain:

• updating, correction, or, if applicable, supplementation of the data;
• erasure, anonymization, or blocking of data processed in violation of the law, including data whose retention is no longer necessary for the purposes for which it was collected or subsequently processed;
• certification that the operations referred to in subparagraphs (a) and (b) have been brought to the attention—including with regard to their content—of those to whom the data has been communicated or disclosed, except where this requirement proves impossible or involves the use of means that are manifestly disproportionate to the right being protected;
• data portability.

4. The data subject has the right to object, in whole or in part:

• on legitimate grounds to the processing of personal data concerning them, even if such data is relevant to the purpose for which it was collected;
• to the processing of personal data concerning them for the purpose of sending advertising material or engaging in direct sales, or for conducting market research or commercial communications