Privacy Policy

Privacy and Security Frecciarossa

PERSONAL DATA PROCESSING NOTICE pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR)

Preamble

The following information is drafted in accordance with Article 13 of EU Regulation UE 2016/679 - Giglio Group S.p.A. Registered Office in Piazza Diaz, 6 - 20123 Milan P. Iva n. IT 07396371002. Numero REA: MI - 2091150

1 Identity and contact details of the data controller

Giglio Group S.p.A. (VAT number 07396371002), with its legal headquarters at Piazza Generale Armando Diaz 6, 20123 Milan, registered with the Milan Business Registry at no., tax code and VAT number IT 07396371002 (hereinafter also "Giglio Group S.p.a" or the "Controller"), is the controller of the personal data of users collected during a purchase on the e-shop website www.frecciarossa.shop ("Site").

Giglio Group S.p.a:

• Piazza Generale Armando Diaz 6
• Phone: +39 02 89094252
• E-mail: areaclienti.frecciarossa@giglio.org

The Data Protection Officer can be contacted at the headquarters of the Controller at the above address and/or by email at dpo.gigliogroup@giglio.org

3 Processing of data by Giglio Group S.p.a for the purpose of executing the purchase contract on the Site

Giglio Group S.p.a, in the case of a purchase on the Site, will process the user's personal data:

to execute the obligations arising from the purchase contract on the Site, such as, by way of example, the delivery of products sold; and to allow the fulfillment of the obligations arising from the customer's purchase contract on the Site, such as, by way of example, the payment of purchased products. The legal basis for this processing is the performance of the contract (Art. 6.1.b of the GDPR).

For this purpose, Giglio Group S.p.a will retain users' data for the time strictly necessary to carry out the individual processing activities (e.g., data necessary for the execution of the purchase contract on the Site until the product is delivered), provided that, after such term, Giglio Group S.p.a may keep the data for the purposes and for the maximum storage periods set out in the following sections of this notice and/or in any case as established by the GDPR and/or by law.

The provision of data for the above purpose is optional, there is no legal or contractual obligation to communicate the data; however, it is a necessary requirement for the conclusion of the purchase contract on the Site: failure to communicate the data will make it impossible for the user to conclude such contract.

4 Processing of data by Giglio Group S.p.a for assistance/customer care purposes related to purchases on the Site

Giglio Group S.p.a, in the case of a purchase on the Site, will process the user's personal data for general assistance and customer care activities related to purchases on the Site and therefore to respond to requests for information from users or to respond to complaints, reports, and disputes.

The legal basis for this processing is the execution of pre-contractual measures adopted at the request of the data subject (Art. 6.1.b GDPR) or, depending on the case, the legitimate interest of Giglio Group S.p.a (Art. 6.1.f GDPR). It constitutes a legitimate interest of Giglio Group S.p.a to respond to requests for information and/or to reports and/or to disputes and/or complaints from users of the Site. The legitimate interest of Giglio Group S.p.a, thus identified, can be considered prevailing over the rights and fundamental freedoms of the data subject, also in view of such reasonable expectations.

The customer has the right at any time to object, for reasons related to his personal situation, to the processing of personal data concerning him for the purpose of assistance and customer care.

To exercise this right, the user can write to Giglio Group S.p.a, Piazza Generale Armando Diaz 6, 20123 Milan at the email address areaclienti@frecciarossa.shop

Further information

In the case of exercising the right to object to the processing of data for the purpose of assistance and customer care, Giglio Group S.p.a will refrain from further processing the personal data of users for this purpose, unless they demonstrate the existence of compelling legitimate reasons for the processing that prevail over the interests and rights and freedoms of the data subject or for the establishment, exercise or defense of a legal claim.

For this purpose, Giglio Group S.p.a will retain customers' data for the time strictly necessary to carry out the activities requested (e.g., for the time necessary to provide the requested information).

The provision of data for the purpose above is optional, there is no legal or contractual obligation to communicate the data; however, given the purpose of the processing, failure to communicate the data and/or the exercise of the right to object may make it impossible to respond to customer requests.

5 Processing of data by Giglio Group S.p.a for administrative/accounting purposes related to purchases on the Site

Giglio Group S.p.a, in the case of a purchase on the Site, will process the user's personal data for the purpose of carrying out administrative/accounting and/or tax obligations connected with the purchase contract on the Site.

The legal basis for this processing is the fulfillment of legal obligations to which Giglio Group S.p.a is subject (Art. 6.1.c GDPR).

The provision of data for this purpose is mandatory because its processing is necessary to allow Giglio Group S.p.a to comply with legal obligations incumbent upon it. Any refusal to provide data for this purpose will make it impossible for the user to make purchases on the Site.

For this purpose, Giglio Group S.p.a will retain the user's data until the expiration of legal terms provided for each administrative-accounting and tax compliance and/or for the periods of retention prescribed by law.

6 Processing of data by Giglio Group S.p.a to allow the user to exercise rights

Giglio Group S.p.a, in the case of a purchase on the Site, will retain users' data for the purpose of:

responding to requests for the exercise of the right of withdrawal and/or requests for the exercise of the legal warranty of conformity and/or other rights arising from the purchase contract carrying out the activities that prove necessary as a consequence of the exercise of such rights and to proceed, if necessary, with the related refunds receiving and responding to requests for the exercise of rights concerning the protection of personal data provided for by the GDPR The legal basis for this processing is the fulfillment of legal obligations (Art. 6.1c GDPR).

Further information

The provision of data for this purpose is mandatory because its processing is necessary to allow Giglio Group S.p.a to comply with legal obligations as well as to enable the user to exercise the rights that the law or contract grants him. Any refusal to provide data for this purpose will make it impossible for the user to exercise such rights.

For this purpose, Giglio Group S.p.a will retain the user's data until the expiration of legal terms provided for the exercise of rights, or for the time necessary to manage and close the case; in the case of the exercise of rights provided by the GDPR, the data will be processed until the controller certifies that they have complied with the request or the fulfillment itself.

7 Processing of data by Giglio Group S.p.a for the purpose of establishing, exercising or defending a right in relation to purchases on the Site

Giglio Group S.p.a, in the case of a purchase on the Site, will retain users' data for the establishment, exercise or defense of a right in all competent venues. The legal basis for this processing is legitimate interest (Art. 6.1.f GDPR).

It constitutes a legitimate interest of the controller to take legal action to ensure respect for its contractual rights or to demonstrate that it has fulfilled the obligations arising from the purchase contract on the Site. Such legitimate interest is based on the constitutionally protected right to defense and can therefore be considered prevailing over the rights and fundamental freedoms of the data subject.

The user has the right at any time to object for reasons related to his personal situation, to the processing of data concerning him for this purpose, by writing to Giglio Group S.p.a at the address Piazza Generale Armando Diaz 6, 20123 Milan or at the email address areaclienti.frecciarossa@giglio.org

Additional Information

Please note that Giglio Group S.p.A will retain the data for the purpose of proving the fulfillment of the purchase contract on the Site and/or to initiate or respond to actions related to such contract; for this purpose, the data will be kept for 10 years from the delivery of the product or the termination of the contract, in case of non-delivery of the product. In the event of exercising the rights provided by the GDPR, the data will be kept for 5 years from the certification of having responded to the request of the interested party.

The provision of data for this purpose is optional: there is no legal or contractual obligation that requires the interested party to provide data for this purpose.

8 Categories of entities to which Giglio Group S.p.A communicates the user's personal data (recipients)

The entities to which Giglio Group S.p.A communicates data act as data processing managers appointed by Giglio Group S.p.A (“Data Processors”) or as persons authorized to process personal data under the direct authority of Giglio Group S.p.A (“Persons in Charge”), or in the case of third parties used by the Data Processor, as "Sub-Processors", in accordance with Article 28.4 of the GDPR, except in cases where the recipient acts (also) as an independent data controller, such as in the case of couriers.

Additional Information

The personal data provided by the user during a purchase on the Site may be communicated by Giglio Group S.p.A to the following categories of recipients:

• Group companies to which Giglio Group S.p.A belongs and/or employees and/or collaborators of Giglio Group S.p.A for the performance of administrative, accounting, and logistical and IT support activities;
• All those subjects (including Public Authorities) who have access to personal data by virtue of regulatory or administrative provisions;
• Companies, consultants or professionals who may be in charge of the installation, maintenance, updating and, in general, the management of Giglio Group S.p.A's hardware and software, including cloud computing service providers;
• Companies or internet providers in charge of sending documentation and/or informational material and/or soft-spam emails;
• All those public and/or private entities, individuals and/or legal persons (legal, administrative, and tax consulting firms, Judicial Offices, Chambers of Commerce, Labor Chambers and Offices, etc.), if the communication is necessary or functional to the proper fulfillment of the contractual obligations assumed in relation to the services on the Site, as well as obligations arising from the law or in the case of establishing, exercising or defending a right in court.

The list of recipients is available at the headquarters of Giglio Group S.p.A.

Data concerning users will not be disseminated.

9 Transfer to third countries

The personal data of customers collected during a purchase on the Site are not transferred to third countries.

10 Rights of the data subject

The data subject has the right to:

• ask the Data Controller for confirmation as to whether or not personal data concerning him or her are being processed and, if so, to gain access to the personal data (right of access);
• obtain from the Data Controller the rectification of personal data concerning him or her without undue delay. Considering the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by providing a supplementary statement (right to rectification);
• obtain from the Data Controller the deletion of personal data concerning him or her without undue delay unless there are legitimate grounds for exemption (right to erasure);
• obtain from the Data Controller the restriction of processing when one of the following applies (right to restriction of processing):
  • The data subject contests the accuracy of the personal data for the period necessary for the Data Controller to verify the accuracy of such data;
  • The processing is unlawful, and the data subject opposes the deletion of the personal data and requests instead that their use be limited;
  • Although the Data Controller no longer needs the personal data for processing purposes, they are required by the data subject for the establishment, exercise, or defense of legal claims;
  • The data subject has objected to the processing where it is based on the legitimate interests of the Data Controller, for reasons related to his or her particular situation, pending the verification whether the legitimate grounds of the Data Controller override those of the data subject;
• receive from the Data Controller personal data concerning him or her in a structured, commonly used, and machine-readable format and have the right to transmit those data to another data controller without hindrance (right to data portability);
• lodge a complaint with a supervisory authority (e.g., the Data Protection Authority) if he or she believes that the processing concerning him or her violates the GDPR;
• object, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her, where the legal basis is the legitimate interest of the Data Controller (right to object). In the case of exercising the right to object, the Data Controller will refrain from further processing personal data unless he can demonstrate compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the data subject or for the establishment, exercise, or defense of legal claims. The rights mentioned in this section may be exercised with a written request to the Data Controller at Piazza Generale Armando Diaz 6, 20123 Milano or at the e-mail address areaclienti.frecciarossa@giglio.org

11 Changes

The Data Controller reserves the right to make changes to this information at any time, giving suitable publicity to the users of the Site and ensuring in any case an adequate and similar protection of personal data. In order to view any changes, users are invited to regularly consult this information.

Privacy Policy