EU Regulation 2016/79
(General Data Protection Regulation)
1. What kind of data do we need?
- Category 1 data: name, surname, address, place, city, province, country, ZIP code;
- Category 2 data: VAT number, tax code, landline⁄mobile phone number, IBAN
- Category 3 data: fax number, Skype account, email address, internet website;
- Category 4 data: photocopy of ID document;
- Category 5 data: body measurements for the production of tailored clothing, to be subsequently codified in a unique “personal draft” for our files, pictures of the subject;
- Category 6 data: data concerning video surveillance systems;
- Category 7 data: details of criminal records.
We would like to specify that the collection and subsequent processing of data concerning minor subjects shall always be subject to the explicit consent of the holder of parental responsibility.
2. Why do we need the data, and what do we do with them?
In case of purchase or sale of goods⁄services and with reference to each category, we need Your data as detailed above, or part of them, for the following purposes:
- the “category 1” and “category 2” data are usually necessary to create and develop a business relationship, such as the purchase of a product⁄service or the sale of clothing manufactured by Belvest, or the sale of fabric, buttons, lining, finished products to the factory outlet or in our warehouses. Such data can concern both “legal” persons, such as companies, shops, etc. (“Business to Business” channel, hereinafter, also “B2B”), and individuals, if the sale is made through our e-commerce site (“Business to Consumer” channel, hereinafter, also “B2C”); denial of consent for the processing of these personal data prevents any other subsequent activity;
- with particular reference to the e-mail address (“category 3”), provision thereof is mandatory only in the case of sales made through the company e-commerce site; it is not necessary for any other sales⁄purchasing service, in which cases it is requested simply in order to streamline communications between the parties and inform customers directly on promotional and marketing activities from time to time organised by Belvest S.p.A.; in any case, this address shall be provided to Belvest S.p.A. only with prior explicit consent, which can be revoked at any time by the data subject;
- the collection of “category 4” data is necessary in case of purchases from Belvest S.p.A. paid with cheques⁄credit cards by private individuals, in order to check the customer’s solvency;
- all or part of the “category 5” data, and all or part of “category 1,2 and 3” data, are clearly necessary if a subject requires the production of “tailored” clothing; consent to the processing of such data must be given explicitly and a denial prevents any further activity;
- “category 6” data are necessary to support company security activities, as specified in areas subject to video surveillance;
- “category 7” data can be collected through access to business data bases.
3. Personal data of natural persons obtained through existing or future business relations with legal entities (customers or suppliers)
If the data to be collected refer to business relationships with legal entities - be they customers or suppliers, existing or developing, we can still obtain all or part of the “category 1,2,3,4,5,6,7” data concerning:
- “category 1,2,3,4,5,6,7”: the processing of Your personal data in the case of “partnerships of one or more subjects (e.g. limited, general and limited liability partnerships, professional firms, etc.);
- “category 1,2,3,6”: the processing of personal data concerning Your employees⁄consultants⁄collaborators who are going to interact with our employees⁄consultants⁄collaborators for the execution of the business contract for the existing or developing purchase⁄sale (e.g. email messages concerning order status updates, phone calls, messages, sms, etc.);
- “category 5”: management of the personal clothing of “natural persons” who are Customers⁄employees⁄consultants⁄collaborators of Yours, when they request a “tailored” garment.
- We suggest you inform your employees⁄collaborators⁄consultants and⁄or final customers that their personal data in the categories mentioned above are liable to be processed as specified below.
4. Who processes the collected data?
Your personal data may be processed by all or part of the offices⁄departments1 of Belvest, by the respective employees⁄consultants⁄collaborators who shall operate in the capacity of processors or persons in charge of processing, established in Italy, Via Corsica 23 Piazzola sul Brenta, CAP 35016, (PD). Moreover, such data may be processed also by other subjects, as:
- in the case of clients requesting “tailored”garments, some category 5 data (name, surname, draft code) are shown on a label placed inside the garment and called “CEM” and subsequently processed by the Belvest1 staff and by the entire production department and by the shipping agent entrusted with their delivery, if the final customer’s name must be shown on the bill of lading and⁄or the invoice;
- for all types of purchasing⁄sales agreements, and without prejudice for the communications and notices given in compliance with the law, all or part of the category 1,2,3 data can be communicated, exclusively for the purposes of the execution of the purchasing⁄sales agreement, to our sales network (including also category 5 data); to our professional consulting staff2; to legal⁄natural persons appointed as “Data Processors”3; to other suppliers, for activities such as production control by computerised means, storage, transport, shipping; to insurance companies; to credit institutions; to factoring companies; to credit insurance companies; to collection agencies2; to companies providing documents optical filing and⁄or microfilming services; to surveillance and control bodies.
No other third party supplier has access to Your data. Data hosting and filing are performed in the Belvest S.p.A. Headquarters concerning customer orders data and the purchase of products⁄services, while some category 1,2,34 data necessary for the creation of a customer profile for e-commerce services and for the delivery of products, are stored also on an Aruba server located in Arezzo, in the “DC1” Data Center. Provided explicit consent to email-marketing activities was given, Your data might be transferred abroad, to the USA, on the servers of our e-mail marketing platform supplier, with whom we have executed a “Data Processor Agreement”. Similarly, in order to guarantee the encryption of emails from Belvest, we use a “GDPR compliant” supplier which might entail the transfer the data to the USA. No other instances of data transfer outside the European Economic Area (EEA) are present. Data exchanged through social networks (Facebook, Instagram) using the “like” function or posting comments, are neither processed nor stored and are not subject to profiling activities, except in pseudonymised and aggregated form. In case of hard copy files concerning sales - including for “tailored” garments - and purchase orders, data can be stored also in the Belvest headquarters in Milan, Corso Matteotti 3. Your personal data shall not be disseminated in any way.
5. How long do we store the collected data?
The law requires us to store documents pertaining to our business relationships (orders, bills or lading, invoices, etc.) for 10 years, and this includes any personal data pertaining to said contracts. After 10 years all personal data of the subject shall be irretrievably deleted or completely pseudonymised. Your e-mail address and, in general, any data collected subject to consent and used to inform the data subject of promotional or marketing activities shall be retained until the data subject should revoke consent, which can be done at any moment by clicking on the relevant link at the bottom of the received e-mail message or by filling in the form that can be downloaded from www.belvest.com, “Privacy” section. In the case of “category 4”data, the maximum storage period is 5 business days. Video surveillance data are stored for a maximum of 72 hours.
6. What are the data subject rights in connection with the data processing?
If you believe that the data collected and stored by us and concerning your person are erroneous or incomplete, you can request to see, correct or delete such information. For clarification or complaints regarding the processing of Your data, please contact us at the following e-mail address: firstname.lastname@example.org, or you may contact the acting Data Processor Eng. Bruno Stefanutti at the following address: email@example.com. If, our best efforts notwithstanding, you are not satisfied with the way your data are being processed, you can address a complaint to the Data Protection Authority, following the link in the “Privacy”section of the www.belvest.com website.
1 Sales Department, Styles Office, CAD, Purchasing Department, Administration, Planning Office, Human Resources, IT Systems, Technical Office, Technical Office Secretary Office, Raw Materials Warehouse, Finished products Warehouse, Factory Outlet.
2 also category 4 and 7 data, the latter in case of litigation.
3 Data Processors.
4 country, email, phone number, address, ZIP code, name, surname