Privacy Policy

SPIVAL SPA, with registered office at VIA MARCONI 214 in LARCIANO (PT), Tax Code and VAT No. 01213190471, acting as the Data Controller, hereby informs you pursuant to Article 13 of EU Regulation No. 2016/679 – GDPR – that your data will be processed according to the following methods and for the following purposes:

1.Types of data processed

The Data Controller processes personal data (e-mail), referred to as "identifying data", provided by you when submitting a request or during subsequent communications with the Data Controller. The data thus obtained will be used solely for the provision of the requested service. The Data Controller also processes personal data collected automatically by the website, such as cookies and usage data, including:

Internet Protocol (IP) address;
browser type;
parameters of the device used to connect to the site;
name of the Internet Service Provider (ISP);
date and time of visit;
visitor's referring web page (referral) and exit page;
possibly the number of clicks.

This data is used for statistical and analytical purposes in an exclusively aggregated form. The IP address is used solely for security purposes and is not cross-referenced with any other data.
No cookies are used for user profiling, nor are any other tracking methods employed. Instead, session (non-persistent) cookies are used strictly to the extent necessary for the secure and efficient navigation of the website. The storage of session cookies on devices or browsers is under the user's control, whereas on the servers, at the end of HTTP sessions, cookie-related information remains recorded in the service logs, with retention periods not exceeding seven days, just like other browsing data.

2.Purposes of the processing

"Identifying" personal data are processed without your express consent to allow the dispatch of the catalog and for activities such as commercial information and requests.

3. Processing methods

The processing of personal data is carried out by means of the operations indicated in Art. 4 No. 2) of the GDPR, namely: collection, recording, organization, storage, consultation, processing, retrieval, disclosure, erasure, and destruction.
The Data Controller will process the personal data for the time necessary to fulfill the aforementioned purposes, and in any case for no longer than 10 years from the termination of the relationship.
Processing is carried out using electronic and manual systems in accordance with the principles of fairness, lawfulness, and transparency provided for by the regulations, through technical and organizational security measures to ensure an adequate level of security.

4. Data access

Personal data may be made accessible for the purposes referred to in Art. 2:

to employees and collaborators of the Data Controller, in their capacity as persons authorized to process personal data;
to third-party companies or other entities—such as those providing IT system management services; entities providing website management services; professionals providing assistance and consulting; private entities directly involved in the performance of the service or legally entitled to access the data—in their capacity as external Data Processors.

5. Disclosure of data

The collected data will not be disseminated; without the need for express consent – Art. 6 lett. b) and c) of the GDPR – the Data Controller may communicate the personal data, for the purposes referred to in Art. 2, to: Inspection Bodies, Judicial Authorities, as well as to those subjects to whom communication is mandatory by law and/or for the execution of the mandate. These subjects will process the data in their capacity as independent Data Controllers.

6. Data transfer

Personal data is stored in paper archives located at the Company's headquarters and on servers located within the European Union. However, for certain services, it is necessary to share some of the collected data with services located outside the European Union. In particular, with Google and the Google Analytics, Google Fonts, and Google Tag Manager services, the transfer is authorized based on specific decisions of the European Commission, or based on the standard contractual clauses of the individual services.
It is understood in any case that the Data Controller, if necessary, will have the right to move the servers even outside the EU. The Data Controller guarantees from now on that the transfer of extra-EU data will take place in accordance with the applicable legal provisions, subject to the stipulation of the standard contractual clauses provided by the European Commission, as well as the verification of the possible presence of adequacy decisions.

7. Nature of data provision and consequences of refusing to respond

The provision of identifying personal data is mandatory and indispensable; in the absence thereof, we will not be able to guarantee the requested service.

8. Rights of the data subject

In relation to the processing of personal data, you have the right:

to be informed about: the identity and contact details of the Data Controller; the purposes and methods of the processing; the identity and contact details of the Data Processor;
to obtain from the Data Controller or the Data Processor, without delay:
1. confirmation as to whether or not personal data concerning you are being processed, and communication of such data in an intelligible form;
2. the erasure of your personal data when: I) the data are no longer necessary in relation to the purposes for which they were collected; II) consent has been withdrawn and there is no other legal ground for the processing; III) the data have been unlawfully processed; IV) the data subject has objected to the processing and there are no overriding legitimate grounds for the processing; V) the Data Controller is subject to a legal obligation to erase the personal data;
3. the updating, rectification or, when interested therein, the integration of the data;
4. certification to the effect that the operations as per points 2) and 3) have been notified, as also related to their contents, to the entities to whom or which the data were communicated or disseminated, unless this requirement proves impossible or involves a manifestly disproportionate effort compared with the right that is to be protected;
the right to object, on grounds relating to your particular situation, to the processing of personal data concerning you, pursuant to Article 6(1), letters e) or f);
the right to object to the processing of personal data concerning you for direct marketing purposes;
the right to lodge a complaint with a supervisory authority;
the right to receive the personal data concerning you in a structured, commonly used and machine-readable format, and to transmit those data to another Data Controller without hindrance from the Data Controller to which the personal data have been provided. In exercising your right to data portability, you have the right to have the personal data transmitted directly from one Data Controller to another, where technically feasible;
the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you;
the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

The Data Controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the Data Controller may charge a reasonable fee based on administrative costs. 9. Methods for exercising your rights
You may at any time exercise the above rights by sending to the attention of the Data Controller:

an e-mail to: office@spival.com
a registered letter with return receipt to: SPIVAL SPA, VIA GRAMSCI 214, 51036 LARCIANO (PT), Italy.

9. Data Controller, Processor, and Authorized Persons

The Data Controller is
SPIVAL SPA
VIA MARCONI 214
LARCIANO (PT).
The updated list of data processors and persons authorized to process data is kept at the headquarters of the Data Controller.