1. DATA CONTROLLER

Rizoma S.r.l. (hereinafter “Rizoma” or the “Data Controller”)
Registered office: Ferno (VA), via Quarto 30/32/34
Italian Tax Code and VAT No. 02595720125
Email address: [email protected]
Website: www.rizoma.com (the “Site”)

2. PERSONAL DATA PROCESSED

• Browsing data
• Personal details (name, surname, residence address);
• Contact details (email address and telephone number);
• Data relating to purchases made on the Site;
• Data relating to products selected in the “Wish list”;
• Billing details (e.g. VAT number, tax code, SDI code, etc.);

(jointly also referred to as the “Data”).

3. COLLECTION OF PERSONAL DATA

Browsing data

The computer systems and software procedures used to operate this Site acquire, during their normal operation, some personal data, including the IP addresses or domain names of the computers used by users who connect to the Rizoma Site, the URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used in submitting the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters related to the user’s operating system and computer environment.

These data, collected by means of cookies and metadata described in the Cookie Policy of the Rizoma Site, to which reference is made and used for the sole purpose of obtaining anonymous statistical information on the use of the Site and to check its correct functioning, are deleted immediately after processing. The data could be used to ascertain responsibility in the event of hypothetical computer crimes against the site.

Contact details, personal details, relating to purchases, purchase and use of gift cards, products selected for wish lists and billing details

These data are collected by the Data Controller following their entry on the Site by the data subject at the time of account registration and/or purchase on the Site and will be processed for the purposes and in the manner described in this policy.

Personal and contact data may also be voluntarily communicated by the user during a conversation initiated using the “Chat” icon. Please note that the Chat is managed independently by the company Guuru (terms, conditions and privacy policy are available on the communication screen itself). The content of the conversation and any personal data communicated by users will therefore be transmitted by Guuru to Rizoma and will be processed by the latter as an autonomous data controller, in order to follow up on specific requests from the user (e.g. requests for information on products or purchases), in the manner and for the purposes indicated in this policy.

4. PURPOSE AND LEGAL BASIS OF PROCESSING

In some sections of the Site, in relation to specific services, some of the Data listed above are requested, which will be processed by the Data Controller for the purposes and legal bases indicated below.

• For the execution of pre-contractual measures and/or a contract to which you are a party:

  • for the purpose of registering an account on the website www.rizoma.com (“Account”);
  • for the technical management and administration of the website;
  • to proceed with the purchase of Rizoma products;
  • for the purchase and use of “gift cards”;
  • to use the services reserved for holders of a personal Account on the Site, such as selecting products to include in the wishlist, viewing previous purchases, using customer service also through the “livechat” channel on the Site, etc.;
  • to receive and process inquiries and contact requests correctly;
  • for managing the shipment and delivery of ordered products;
  • Based on a legitimate interest of the Data Controller (soft spam pursuant to art. 130 paragraph 4 of Legislative Decree 196/2003 as amended), for the promotion by email of goods or services similar to those of the sale, without prejudice to the possibility of objecting at any time.

• • Furthermore, subject to your prior, optional and revocable consent at any time, the personal data collected may be processed for further purposes, and in particular for:
    • Marketing: to send you communications about initiatives, commercial offers including on digital media, questionnaires and market research of the Data Controller through digital channels (for example by email);

  In any case, your personal data may be processed, where necessary, also for the following purposes:

  • To comply with legal obligations, and in particular to fulfill obligations provided for by applicable national and supranational laws and regulations (tax, administrative obligations, etc.);
  • Based on a legitimate interest (legal defense), to ascertain, exercise or defend the rights of the Data Controller in judicial and/or out-of-court proceedings.

5. RETENTION PERIOD

• For the entire contractual duration and, after termination, for the ordinary statutory limitation period of 10 years, for processing based on the execution of pre-contractual measures and/or a contract to which the data subject is a party;

• Until the exercise of your right to opt-out for email promotion of services similar to those of the sale, based on the legitimate interest of the Data Controller (soft spam);

• Marketing consent granted by customers who have made a purchase on the Site will be retained for a period of 4 years, corresponding to the average life cycle of Rizoma products or vehicles on which they are installed, and therefore the average expected interest period for new Rizoma products. In any case, data subjects retain the right to renew this consent or withdraw it at any time;

• Data of users who registered an Account without making a purchase will be retained until account cancellation; marketing consent granted by such users will be kept for 2 years, without prejudice to the possibility to renew or withdraw consent at any time;

• For the duration required by law (10 years for accounting and tax requirements) for compliance with legal obligations;

• In case of legal dispute, for the entire duration of the same, until the expiry of terms for appeal, for legal defense based on the Data Controller’s legitimate interest;

• For a period of 7 days for contact data voluntarily communicated through the Chat available on the Site.

Once the above retention terms have expired, personal data will be destroyed, deleted, or rendered anonymous, consistent with technical deletion and backup procedures and accountability requirements.

6. NATURE OF DATA PROVISION

Providing Data for the execution of contracts and compliance with legal obligations is necessary for executing orders and services and fulfilling statutory duties. Any refusal will make it impossible for the Data Controller to provide the requested service.
Providing data for optional purposes is entirely voluntary, and users may exercise their opt-out right at any time. Optional processing refers to fields not marked with an asterisk (*), data voluntarily provided via Chat, and marketing communications based on consent.
For browsing data, please refer to the Cookie Policy accessible via the link in the footer at the bottom of the page.

7. DATA RECIPIENTS

The Data may be processed by authorized company personnel who have received appropriate operational instructions.
Furthermore, Data may be processed by external independent controllers such as supervisory authorities or public bodies entitled by law.
Data may also be processed on behalf of the Company by external data processors (pursuant to art. 28 GDPR), such as:

• website management and maintenance service providers;
• e-commerce platform management providers;
• market research and analysis providers;
• emailing and promotional service providers;
• customer relationship management (CRM) providers;
• IT and telecommunications network providers;
• logistics, postal, and shipping courier providers;
• banking and payment institutions for handling collections and payments.

The complete list of data processors is available upon request using the contact details in Section 9 below.

8. DATA TRANSFERS OUTSIDE THE EUROPEAN UNION

Your personal data will not be transferred outside the European Union.

Should this occur, particularly in reference to cookie data, the Data Controller will adopt appropriate safeguards, including adequacy decisions and Standard Contractual Clauses (SCC) adopted by the European Commission.

9. RIGHTS OF DATA SUBJECTS

Pursuant to Articles 15 et seq. of Regulation (EU) 2016/679, data subjects have the following rights:

• Right to rectification: obtain rectification of inaccurate or incomplete personal data;

• Right to restriction: obtain restriction of processing when accuracy is contested, processing is unlawful, data is no longer needed but required for legal defense, or when objecting pending verification of overriding legitimate grounds;

• Right to access: obtain information about personal data stored, categories of data, purposes, sources, and recipients;

• Right to portability: receive data in a structured, commonly used and machine-readable format and transmit it to another controller where processing is based on consent or contract;

• Right to erasure: obtain erasure of personal data when no longer needed, upon objection, or if processed unlawfully;

• Right to object: object at any time to processing based on legitimate interests;

• Right to lodge a complaint: file a complaint with the competent supervisory authority in your Member State.

You may exercise these rights by contacting the Privacy Office:

• by post: Ferno (VA), via Quarto 30/32/34
• by email: [email protected]

10. CHANGES TO THIS PRIVACY POLICY

Any future changes or additions to the processing of personal data as described in this Privacy Policy will be notified through the usual communication channels used by Rizoma (for example through the Site).