Information regarding the processing of personal data (Privacy) based on Legislative Decree no. 196/2003 (Personal Data Protection Code) and EU Regulation 2016/679

In reference to the provisions of Legislative Decree 196/2003 “Personal Data Protection Code”, and EU Regulation 2016/679, particularly regarding articles 12 and 13, we inform you that your personal data will be processed in accordance with current regulations.

This information notice describes how personal data sent by users during visits and navigation on the site is managed, as well as data obtained during possible registration (by way of example and not exhaustively) to the newsletter, forum, and services offered.

Types of data processed

1. Navigation data
   The computer systems and software procedures responsible for the operation of this website acquire, during their normal operation, some personal data whose transmission is implicit in the use of internet communication protocols. This is information that is not collected to be associated with identified interested parties, but which by its very nature could, through processing and associations with data held by third parties, allow users to be identified. This category includes IP addresses, or domain names used by users who connect to the site, addresses in URI (Uniform Resource Identifier) notation of requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained, etc. This data is used solely to obtain anonymous and aggregate statistical information on site usage and to monitor its proper functioning, and resides permanently on third-party servers (hosting provider). The data could be used to ascertain responsibility in case of hypothetical computer crimes against the site.
2. Cookies
   The website uses cookies to help users speed up navigation, increase security, analyze usage and efficiency of services. For more information, please refer to the Cookie Policy.

Purpose of processing

1. To use the Services offered, you may be required to complete registration forms containing fields for providing mandatory and optional personal data. Providing the personal data indicated as mandatory is necessary to complete the registration procedure; therefore, failure to provide or partial provision of such data makes it impossible to register for the Services and use them. Providing non-mandatory data is optional; therefore, their failure to provide or partial provision does not prevent registration and use of the Services. Personal data for Service registration may differ depending on the registration forms used.
2. Technical data relating to connections (logs) are kept to allow security checks required by law and to improve the quality of services offered and customize them according to user/visitor needs. In compliance with current legal provisions, log files are registered. Such data does not allow user identification except following a series of processing and interconnection operations, and necessarily through data provided by other providers. Operations that can only be carried out at the request of competent Judicial Authorities, authorized by express legal provisions aimed at preventing and/or suppressing crimes.
3. With prior consent given freely, explicitly and in a differentiated form with respect to different processing purposes, by selecting the appropriate box in the Service registration forms, personal data may be processed for sending commercial information, advertising and promotional material related to the site and/or to third-party services or products selected based on data provided in the relevant registration form via email. Consent for the processing purpose referred to in this point 3 is optional; therefore, following a possible refusal, data will be processed only for the purposes indicated above. It will also be possible after registration, automatically and without costs, to object to data processing and not receive promotional and/or commercial communications, while maintaining Service registration, by clicking on the appropriate link at the bottom of all advertising communications sent.
4. Personal data, collected and stored in databases, are processed by employees and/or collaborators of the data controller as data processors. They are not subject to disclosure or communication to third parties, except in cases provided for by this information notice and/or by law and, in any case, in the manner permitted by it.
5. Processing is carried out through automated tools for the time strictly necessary to achieve the purposes for which the data was collected and, in any case, in compliance with current regulatory provisions, particularly based on security obligations relating to data processing pursuant to art. 32 GDPR. To ensure an adequate level of data protection aimed at limiting the risk of improper or unlawful use, technical and organizational measures have been implemented that comply with internationally recognized IT standards, and these measures are constantly verified. Specific security measures are observed to prevent data loss, illicit or incorrect use and unauthorized access. We cannot be held responsible for any unauthorized access or loss of personal information beyond our control.
6. The data controller is Faces s.r.l.s. with headquarters at Via della Scala 16/A – 00153 Rome – ITALY, in the person of its legal representative, who pursuant to and for the effects of articles 13 and 14 of European Regulation 2016/679, hereby informs you that the aforementioned regulation provides for the protection of interested parties with respect to the processing of personal data and that such processing will be based on the principles of correctness, lawfulness and transparency and protection of your privacy and rights. You have the right to obtain from the controller the deletion (right to be forgotten), limitation, updating, rectification, portability, opposition to the processing of personal data concerning you, as well as in general you can exercise all the rights provided for by articles 15, 16, 17, 18, 19, 20, 21, 22 of the GDPR. You can contact the Controller via email at the following address facestshirtstore@gmail.com
7. Right of access to personal data and other rights pursuant to EU Regulation 2016/679: Articles 15, 16, 17, 18, 19, 20, 21, 22.
   1. The data subject has the right to obtain confirmation of the existence or not of personal data concerning them, even if not yet registered, and their communication in intelligible form.
   2. The data subject has the right to obtain indication of:
      • the origin of personal data;
      • the purposes and methods of processing;
      • the logic applied in case of processing carried out with the aid of electronic instruments;
      • the identifying details of the controller, processors and the representative designated pursuant to article 5, paragraph 2;
      • the subjects or categories of subjects to whom personal data may be communicated or who may become aware of it as designated representative in the territory of the State, as processors or data processors.
   3. The data subject has the right to obtain:
      • updating, rectification or, when interested, integration of data;
      • deletion, transformation into anonymous form or blocking of data processed in violation of law, including those for which conservation is not necessary in relation to the purposes for which the data was collected or subsequently processed;
      • attestation that the above operations have been brought to the attention, also regarding their content, of those to whom the data has been communicated or disclosed, except in cases where such compliance proves impossible or involves the use of means manifestly disproportionate to the protected right; data portability.
   4. The data subject has the right to object, in whole or in part:
      • for legitimate reasons to the processing of personal data concerning them, even if relevant to the purpose of collection;
      • to the processing of personal data concerning them for the purpose of sending advertising material or direct sales or for conducting market research or commercial communication.
   5. The data subject has the right to receive their own data or have it transferred to another controller.
      The user has the right to receive their own data in structured, commonly used and machine-readable format and, where technically feasible, to obtain its transfer without obstacles to another controller. This provision applies when data is processed with automated tools and processing is based on user consent, a contract to which the user is a party or contractual measures connected to it.
   6. How to exercise rights
      To exercise user rights, users can address a request to the Controller’s contact details indicated in this document. Requests are filed free of charge and processed by the Controller as soon as possible, in any case within one month.
8. The site uses temporary markers (cookies). For the extended cookie policy click here.
9. Contact form, Mailing List or Newsletter
   The user, by filling out the contact form with their data, consents to their use to respond to requests for information, quotes, or any other nature indicated by the form header. By registering for the mailing list or newsletter, the user’s email address is automatically inserted into a contact list to which email messages containing information, including commercial and promotional in nature, related to this website may be transmitted.

Processing methods

Personal data is processed with manual, electronic tools, through automated systems and also through cookies for the time strictly necessary to achieve the purposes for which it was collected. Each processing takes place in compliance with the methods indicated in articles 6, 32 of the GDPR and through the adoption of adequate security measures provided. Processing connected to web services is carried out on servers located at external providers (the name is available by contacting the Controller) and stored at the locations where the physical servers are located.

Communication

Your data is processed within the company by the following categories of authorized subjects appointed as processors by the Controller:

• Marketing Dept.
• Information Systems

Your data may be communicated to third parties, particularly to:

• External provider
• Companies that perform ordinary and extraordinary maintenance of the website
• Companies that provide services related to third-party cookies

Disclosure

Your data will not be disclosed.

Retention period

We inform you that, in compliance with the principles of lawfulness, purpose limitation and data minimization, pursuant to art. 5 of the GDPR, the retention period of your personal data is established for a period not exceeding the completion of the services provided. When processing is based on user consent, the controller may retain personal data longer until such consent is revoked. Furthermore, the Controller may be required to retain personal data for a longer period in compliance with a legal obligation or by order of an authority. At the end of the retention period, personal data will be deleted. Therefore, upon expiration of this term, the right of access, deletion, rectification and the right to data portability can no longer be exercised.

Third parties

Your data is also collected through tools and services provided by third parties and stored by them. For more information, please refer to the Cookie Policy.

Last modified, January 19, 2021