Privacy Policy

Privacy Policy

Information pursuant to Article 13 of Reg. 2016/679/EU on the processing of personal data (so-called "GDPR")

The following information concerns the processing of data by Lenzokart Ltd. on the sites www.lenzokart.it other proprietary websites and services.

Processing of personal data

Processing of personal data" means any operation or set of operations, performed with or without the aid of automated processes and applied to personal data or sets of personal data, even if not recorded in a database, such as collecting, recording, organizing, structuring storage, processing, selection, blocking, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, comparison or interconnection, restriction, erasure or destruction.

Lenzokart s.r.l., manifests the highest attention to the protection of personal data having adopted appropriate and necessary measures for the protection of data and their preservation by virtue of the application of the national and European regulations of reference and having examined every risk related to the activities mentioned above.

Access to certain sections of the site and/or any requests for information or services by users of the site may be subject to the inclusion of personal data, the processing of which, will be carried out in accordance with the General Data Protection Regulation (EU Regulation 2016/679) and current national legislation.

The purpose of this notice is to allow users to know, even before accessing the various sections of the site and conferring their data, how Lenzokart Srl processes the personal data of users and it will still be necessary for the user to read it before conferring their personal data by filling in the appropriate spaces in the various sections of the site, providing consent to the processing of data.

Processing will be carried out manually and electronically or otherwise using computerized or automated means.

According to the rules of the Code and the Regulations, the processing carried out by the Controller will be based on the principles of fairness, lawfulness and transparency and protection of confidentiality.

Subject of processing and mode of collection

The Data Controller processes personal, identifying data (e.g., first name, last name, address, social security number, telephone number, e-mail, bank and payment references) - hereinafter, "personal data" or also "data" communicated by the Data Subject when concluding a contract for services offered by the Data Controller.

The personal data being processed were collected directly from the Data Subject.

In addition to the personal data conferred directly by the user, when connecting to the site, the computer systems and software procedures responsible for the operation of the site itself indirectly acquire some personal data whose transmission is implicit in the use of Internet communication protocols.

Purpose of processing and legal basis

The provision of data is optional, but it is, in part, necessary (i.e., for those data whose boxes are marked with an asterisk) so that Lenzokart s.r.l., can meet the needs of the user within the scope of the functionality of the site.

Failure, partial, inexact provision of personal data marked with an asterisk, as they are necessary for the performance of the requested service, does not make such performance possible; while failure, partial, inexact provision of optional personal data that are not necessary does not entail any consequences.

Personal data will be processed by the Owner on a primary basis exclusively for purposes strictly related and instrumental to the fulfillment of the obligations inherent in the contractual relationship, pre-contractual and fiscal obligations and the fulfillment of obligations under current legislation and, in particular:

(a) to conclude contracts for services offered by the Holder;

b) fulfill pre-contractual, contractual and tax obligations arising from existing relations with the Interested Party;

(d) to fulfill obligations under civil and/or tax laws;

(e) to comply with obligations under a regulation, whether national or international in nature, EU legislation, or an order of the Authority (such as in the area of anti-money laundering);

(f) to exercise the rights of the Owner, for example, the right of defense in court.

Access, communication and dissemination of personal data in pursuit of the primary purposes of processing..

In all cases outlined above for the pursuit of the primary purposes, the data of the Data Subject may be made accessible and brought to the attention of:

employees, workers and in-house consultants in charge of administrative, secretarial, technical or other tasks and collaborators of the Controller, who, operating under the direct authority of the latter, have been appointed as data processors and have received, in this regard, appropriate operational instructions;
third-party companies or other entities (by way of example: professional firms, consultants in charge of carrying out legal and/or tax activities, to entities that carry out data processing and/or bookkeeping activities and consequent fulfilments on behalf of the Data Controller) that carry out activities on behalf of the Data Controller, in the capacity of external data processors and that, in turn, have issued, in this regard, adequate operating instructions to their employees and managers.

The Holder may also communicate personal data externally to the following third parts to whom the communication is necessary for the fulfillment of the contract and the obligations arising therefrom, pre-contractual and tax obligations and, more generally, for the fulfillment of obligations under current legislation.

With this in mind, personal data may be disclosed by the Data Controller to the following:

to the judicial and police authorities or other public administrations for the fulfillment of regulatory obligations;
to credit institutions for handling collections and payments;
to companies engaged in the operation and maintenance of electronic communication equipment;
to all natural and legal persons in cases where communication is necessary for the primary purposes of processing.

Those individuals will process the data in their capacity as autonomous data controllers.

Exclusion of the need to acquire consent to the processing of personal data.

In all the cases illustrated above (for the hypotheses of communication to third parties) the Data Controller is not obliged to acquire specific consent to the processing of data because all the processing illustrated above pursues primary purposes for which Article 24 of the Privacy Code and Art. 6, para. 1, letters b), c) e) and f) of the Regulations exclude the need to acquire specific consent, either because the processing is necessary to fulfill an obligation provided for by law by a regulation or by EU legislation, or because the processing is necessary to perform obligations arising from the contractual relationship to which the Data Subject is a party or to fulfill, prior to the conclusion of the contract, specific requests of the Data Subject. Where the Interested Party does not intend to provide the personal data requested and necessary on the basis of the foregoing anyway, the consequence would be the impossibility for the Controller to fulfill the obligations and execute the contract.

Promotional, advertising and marketing purposes

Personal data collected as part of the signing of the contract or the previous relationships that led to the formalization of the same may be, also, processed by the Owner, both in paper mode (eg: compilation of forms, coupons and similar paper subsequent use electronically) and in an automated/informatics mode, for purposes of commercial promotion, advertising communication, solicitation of purchasing behavior, market research, surveys (including telephone, online or through forms), statistical processing (in identifiable form), other marketing sample research in the broad sense (including prize shows, games and contests), hereinafter collectively referred to as "Processing for Marketing Purposes".

By giving consent to the Processing for Marketing Purposes, the Data Subject specifically acknowledges such promotional, commercial and marketing purposes in the broad sense of the processing (including the consequent management and administrative activities) and expressly authorizes the Data Controller to proceed with such processing both pursuant to Article 23 of the Privacy Code (where the means employed for the Processing for Marketing Purposes are telephone with operator or other non-electronic, non-telematic means or not supported by automatic, electronic or telematic mechanisms and/or procedures), and pursuant to Article 130 of the Privacy Code (where the means employed for the Processing for Marketing Purposes are electronic mail, fax, sms, mms, automatic systems without operator intervention and similar, including electronic platforms and other telematic means), which - finally - pursuant to Art. 6, paragraph 1, letter (a) of the Regulations.

Pursuant to the General Provision of the Privacy Guarantor of May 15, 2013 entitled "Consent to the Processing of Personal Data for the Purposes of 'Direct Marketing' through Traditional and Automated Contact Tools," the attention of the Data Subject is specifically drawn to the fact that:

any consent given for the sending of commercial and promotional communications, on the basis of Article 130, paragraphs 1 and 2, of the Code (i.e., through the use of electronic mail, fax, sms, mms, automated systems without operator intervention and similar, including electronic platforms and other telematic means) will imply the receipt of such communications, not only through said automated modes of contact, but also through traditional modes, such as paper mail or operator calls;
the Data Subject's right to object to the processing of his or her personal data for the purposes of "direct marketing" through the above-mentioned automated means of contact, will in any case extend to the traditional ones and, even in this case, the possibility of exercising this right in part, as provided for in Article 7, paragraph 4, of the Code, both with respect to certain means and with respect to certain processing, remains unaffected;
it remains without prejudice to the possibility for the Interested Party who does not intend to give consent in the terms indicated above, to express any desire to receive communications for the aforementioned Marketing Purposes exclusively through traditional methods of contact, where provided for: this desire may be exercised free of charge by sending a simple email to the email address: [email protected]

For the purposes of the principle of fulfillment of privacy obligations for the Holder in compliance with the principles of simplification of the same obligations (Art. 2 of the Code) and pursuant to the aforementioned General Provision of the Privacy Guarantor of May 15, 2013, the Data Controller informs the Data Subject that the specific consent formula available according to the consent collection procedures from time to time provided for will be unified and comprehensive and will refer to all possible means of marketing processing, ex articles 23 and 130 of the Code, without prejudice to the possibility for the Data Subject to notify by email to the [email protected] , a different will as to the use of certain means and not others for the receipt, subject to consent, of marketing communications. In addition, again for the purposes of the principle of fulfillment of privacy obligations for the Data Controller in compliance with the principles of simplification of the same obligations (art. 2 of the Code), the Data Controller informs the Data Subject that the specific consent formula will be unified and overall and will also refer to all the different and possible marketing purposes explained herein (i.e. without multiplying the consent formulas for each distinct marketing purpose pursued by the Data Controller), without prejudice to the possibility for the Data Subject to notify by email to the email address: [email protected] a different selective will as to the consent or refusal of consent for individual marketing purposes.

In order to proceed with Processing for Marketing Purposes, it is mandatory to acquire specific, express, documented, prior and entirely optional consent.

Consequently, where the Data Subject decides to give specific consent, he or she must be informed in advance and aware that the purposes of the processing pursued are of a specific commercial, advertising, promotional and marketing nature in the broadest sense. With a view to absolute transparency, the Data Controller informs the Data Subject that the data will be collected and subsequently processed on the basis of specific provision of consent:

to send advertising and informational materials (e.g., Newsletters), of a promotional or otherwise commercial solicitation nature, pursuant to Articles 23 and 130 of the Privacy Code;
to carry out direct sales or placement activities of Holder's products or services;
to send commercial information; carry out interactive commercial communications also pursuant to Article 58 of Legislative Decree 206/2005 through the use of email;
to prepare studies, research, market statistics;
to send unsolicited commercial communications in accordance with Article 9 of Legislative Decree No. 70 of April 9, 2003 implementing the so-called Electronic Commerce Directive 2000/31/EEC, which stipulates that unsolicited commercial communications must be immediately and unequivocally identifiable as such and contain an indication that the recipient of the messages may object to receiving such communications in the future.

Thus, by giving optional consent, the Data Subject specifically acknowledges and authorizes such additional, possible secondary processing.

In any case, even where the Data Subject has given consent to authorize the Data Controller to pursue all the purposes mentioned in points 1 to 5 above, he or she will remain free at any time to revoke it by sending a clear communication to that effect to the email address without any formality: [email protected] .

Upon receipt of such an opt-out request, the Data Controller will promptly proceed to remove and delete the data from the databases used for Processing for Marketing Purposes and to inform for the same purposes of deletion any third parties to whom the data has been disclosed. The mere receipt of the request for deletion will automatically count as confirmation of successful deletion.

The Data Subject is specifically and separately informed, as required by Article 21 of the Regulations that if personal data are processed for direct marketing purposes, the Data Subject has the right to object at any time to the processing of personal data concerning him or her carried out for such purposes and that if the Data Subject objects to the processing for direct marketing purposes, the personal data may no longer be processed for such purposes.

Data processing for commercial profiling purposes

It is possible that for marketing and service improvement purposes, the Owner may process so-called "profiling" data in order to assess certain aspects or to analyze or predict aspects regarding economic situation, preferences, interests, reliability, etc.

Profiling activities may concern "individual" personal data or "aggregate" personal data derived from detailed individual personal data.

5.1 Consent to treatment.

In order to proceed with Profiling Processing, it is mandatory to acquire specific, separate express, documented, prior and entirely optional consent.

The provision of personal data to the Data Controller and the provision of both the consent to the profiling treatment and the separate consent to the communication to third parties for the profiling treatment are absolutely optional and optional (and in any case revocable without formality even after the provision) and the failure to provide them will not lead to consequences other than the impossibility for the Data Controller and any third party to proceed with the mentioned treatments only.

Modality, time of storage of personal data and other information

Personal data will be processed in a predominantly automated form, with logic strictly related to the aforementioned purposes by the owner's internal staff and collaborators, external parties expressly appointed as data processors.

Outside of these cases, the data will not be communicated to third parties or disseminated except in cases expressly provided for by national or European Union law.

The data will be processed for the duration of the contractual relationships established and also thereafter for as long as the Holder is subject to retention obligations for legal fiscal and other purposes, provided for by law and/or regulations.

On the other hand, with reference to personal data subject to Processing for Marketing Purposes or Processing for Profiling Purposes, the same will be retained in compliance with the principle of proportionality and in any case until the purposes of the processing have been pursued or until - if previously - the revocation of the specific consent by the Data Subject.

Owner, data controllers and data processors

The data controller is the Lenzokart Srl, Via Ferrara snc 98061 Brolo (Me), VAT 02085560833 Email: [email protected] .

The updated list of Data Processors and Processed Persons is available at the registered office of the Data Controller and can be consulted by making an informal request, including by email to the following email address: [email protected]

Rights of the data subject

Pursuant to Article 7 of the Privacy Code and pursuant to Articles 13, paragraph 2, letters (b) and (d), 15, 18, 19 and 21 of the Regulations, we inform the Data Subject has the following rights:

a) has the right to ask Lenzokart Ltd. as the data controller for access to personal data, rectification or erasure of the same or restriction of processing concerning him or her or to object to their processing, in the cases provided for;
b) has the right to file as a Data Subject a complaint with the Data Protection Authority, following the procedures and directions published on the Authority's official website at www.garanteprivacy.it;
(c) any rectification or deletion or restriction of processing made at the request of the Data Subject - unless this proves impossible or involves a disproportionate effort - will be communicated by the Controller to each of the recipients to whom the personal data were transmitted. The Controller may notify the Data Subject of such recipients if the Data Subject so requests.

In particular, the data subject will be able to:

1°) obtain confirmation of the existence or non-existence of personal data concerning him/her, even if not yet registered, and their communication in an intelligible form;

2) getting the indication:

(a) of the origin of personal data;
(b) of the purposes and methods of processing;
(c) of the logic applied in the case of processing carried out with the aid of electronic instruments;
d) of the identification details of the owner, managers and designated representative in accordance with Article 5, paragraph 2 Privacy Code and Article 3, paragraph 1 GDPR;
e) of the subjects or categories of subjects to whom the personal data may be communicated or who may become aware of them in their capacity as designated representative in the territory of the State, managers or appointees.
Modalities for the exercise of rights by the data subject

The exercise of rights is not subject to any form requirement and is free of charge.

The address for exercising rights is: [email protected]

Alternatively, the Interested Party may, at any time, exercise the rights by sending a registered letter with return receipt to the following address: Lenzokart Srl,Via Ferrara snc, 98061 Brolo (Me).