The data controller is Cicli Pinarello S.r.l., with registered office in Italy, Villorba (TV), Viale della Repubblica n. 12, Tax Code and VAT no. 05994100963, (hereinafter, the "Data Controller"), as Data Processor, informs you, pursuant to Articles 13 and 14 of the EU Regulation n. 2016/679 (hereinafter "GDPR") that your data will be processed in the following ways and for the following purposes.

1. Purposes of processing and legal basis.

The Controller processes the personal data (e.g. first name, surname, company name, tax code, VAT number, sex, e-mail address, telephone number, height, body weight, age, body measurements, etc.) - hereinafter referred to as 'Data' – provided by you when completing the order form at the point of of sale:

1. without your express consent, pursuant to Art. 6(c) GDPR, to comply with legal and administrative obligations;
2. without your express consent, pursuant to Art. 6(f) GDPR, based on the legitimate interest in improving the quality of the services rendered by Cicli Pinarello and, at the same time, in providing technical assistance to its customers;
3. with your written express consent, pursuant to Art. 6(a) and Art. 7 GDPR, for the purpose of finalising the order and executing the order, for the purpose of customising the product ordered, as well as for the purpose of handling requests for information and/or requests for assistance, resulting in customer satisfaction;
4. always with your written express consent, pursuant to art. 6, lett. a) and art. 7 GDPR, for the following purpose: sending of newsletters and/or promotional messages (including via e-mail and/or phone) by Cicli Pinarello S.r.l. concerning commercial information related to the Controller or to products and/or services offered by the same ("Direct Marketing").

2. Categories of recipients of personal data.

The Data will not be disclosed to anyone other than the authorised parties listed below under any circumstances.

For the purposes referred to in paragraph 1 above, the Data provided by you will be made accessible:

1. to employees and/or collaborators of the Controller authorised for processing; and
2. to third parties performing outsourcing activities on behalf of the Controller in their capacity as data controllers.

The Data Controller may also disclose your data to third parties who will process the Data in their capacity as autonomous data controllers, such as judicial or supervisory bodies and authorities, public administrations, bodies and organizations (Art. 1(B)).

An up-to-date list of the above-mentioned persons is kept at the registered office of the Controller.

3. Data storage.

Data is stored on paper and/or physical media and/or on servers located within the European Union, owned by and/or at the disposal of the Data Controller and/or third party companies duly appointed as data processors.

4. Transfer of personal data abroad.

Data will be processed by the Data Controller within the European Union, but in case of transfer of Data to third parties based outside the territory of the European Union (hereinafter "Third Country"), the Data Controller shall ensure that the Third Country is subject to an adequacy decision of the Commission or adequate safeguards in accordance with Regulation (EU) 2016/679 and any other applicable legislation.

In the absence of an adequacy decision of the Commission, or adequate safeguards, the requirements of Article 49 of Regulation (EU) 2016/679 will be complied with by the Controller (by way of example, it will be the responsibility of the Controller to collect the consent of the Data Subject to the transfer of the Data after having been informed of the possible risks of such transfers).

5. Data retention periods.

Data will be retained for a limited period of time that varies depending on the type of activity and the purpose for which the Data are processed.
After this period, the Data will be definitively deleted, destroyed or otherwise irreversibly anonymised. This is without prejudice to cases where retention for a later period is required for litigation, requests by the competent authorities or under applicable legislation.
In particular, Data are retained in compliance with the terms and criteria specified below:

• data collected to conclude and execute purchase contracts, including payment data: until the conclusion of the administrative-accounting formalities. Invoice-related data shall be stored for 10 (ten) years from the invoice date;
• data related to requests for information and/or requests for assistance: data used to process the customer's request will be stored until that request is fulfilled;
• data used for commercial communication activities and/or direct marketing purposes in respect of customers who have voluntarily subscribed to the Controller's newsletter: these data are stored until the cessation of activity or the request to discontinue the activity (withdrawal of consent) and in any case within 2 (two) years of the customer's last interaction, of any kind, with the Controller. The customer may, at any time, independently stop receiving these communications by simply clicking on the appropriate link at the bottom of each e-mail.

In any case, this is without prejudice to the right of the Data Controller to process and then retain the data for as long as is strictly necessary to protect its rights in order to settle judicial or extrajudicial disputes.

6. Data processing methods.

The processing of your Data is carried out by means of the operations indicated in Article 4 no. 2) GDPR: collection, recording, organisation, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, deletion and destruction of data.

Data is processed using instruments (paper, IT or telematic) suitable for guaranteeing security and confidentiality according to the so-called data protection by default, i.e. the application of measures to minimise the risks of data dissemination.

7. Rights of the data subject and how to exercise them

You may exercise the rights set out in Articles 15-21 of the GDPR, including:

1. right of access, i.e. the right to obtain from the Controller confirmation as to whether or not the Data are being processed and, if so, to obtain access to them;
2. Right of rectification and erasure, i.e. the right to have inaccurate Data rectified and/or incomplete Data supplemented or erased for legitimate reasons;
3. the right to restriction of processing, i.e. the right to request the suspension of processing where there are legitimate reasons;
4. the right to data portability, i.e. the right to receive the Data in a structured, commonly used and readable format, as well as the right to transmit the Data to another data controller;
5. right to revoke consent at any time without prejudice to the lawfulness of the processing based on the consent provided prior to revocation;
6. right to object, i.e. the right to object to the processing of Data where there are legitimate grounds, including the processing of Data for marketing and profiling purposes, if any;
7. right to appeal to the competent data protection authority in the event of unlawful processing of Data.

To exercise these rights, send an e-mail to privacy@pinarello.com or a registered letter to: Cicli Pinarello S.r.l., Viale della Repubblica no. 12, Villorba (TV), Italy.

8. Security measures.

Appropriate security measures to prevent unauthorised access, disclosure, modification or destruction of Data. Processing uses IT/telematic and/or paper tools, applying suitable organizational, technical, and administrative measures within the company, strictly related to the stated purposes.