Skip to main content

Customer privacy policy

INFORMATION ON THE PROCESSING OF CLIENTS' PERSONAL DATA

This privacy notice is provided by PIN CRAFT S.r.l. (hereinafter the "Company" or the "Data Controller") to natural person clients as well as to contact persons (e.g., employees/collaborators/representatives) of legal entity clients who enter into a contractual relationship with the Company (hereinafter collectively the "Clients" or "Data Subjects") for the sale of goods and services by the Company. In accordance with Articles 12 et seq. of EU Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data ("GDPR"), the Company informs Clients about the procedures, lawful bases, and rights regarding the processing of their personal data collected and processed for the establishment, management, and execution of the contractual relationship.

DATA CONTROLLER

The Data Controller of your personal data is the company PIN-CRAFT S.r.l., with registered office at via dei Comparini n. 85, 55049 Viareggio (LU) – Italy, registered with the Companies Register of Lucca, VAT no. 01965100462; contact details: tel. +39 0584-383930, e-mail: info@pin-craft.com.

DATA PROTECTION OFFICER

Pursuant to Art. 37 of the GDPR, Pin-Craft has appointed a Group Data Protection Officer (or DPO) who can be contacted via email at dpo@opacmare.it.

SOURCES AND CATEGORIES OF DATA PROCESSED

For the processing purposes indicated in section 4 below, the Company processes the following categories of Clients' personal data collected directly from them or through its intermediaries (distributors, agents, or after-sales assistance providers) if the relationship is established through such parties:

  • Personal identification data (first name, last name, other numbers or identification elements)
  • Tax data (fiscal code, VAT number)
  • Contact details (address, telephone number, e-mail, etc.)
  • Professional data (e.g., job title)
  • Payment data
  • Billing data
  • Special categories of data: we do not process any data qualifying as "special categories" under Art. 9 of the GDPR, except in cases required by law

PURPOSES AND LEGAL BASES FOR PROCESSING

The Data Controller processes the personal data of Clients who have contractual relationships with it. The purposes of data processing for managing Client relationships are as follows:

  1. Management of pre-contractual and contractual relationships, including the acquisition of preliminary information prior to contract conclusion, verification of provided documentation, database creation, management of orders, sales, deliveries, databases, complaints, after-sales service, and communications. The legal basis for this processing is the exercise of rights and performance of pre-contractual and contractual obligations with Clients (Art. 6.1(b) GDPR).
  2. Compliance with accounting, tax, and other legal obligations, such as tax and social security compliance, accounting entries, management/archiving (including electronic format where applicable) of invoices, and verification of salary and social security documentation in the case of contractors. The legal basis for this processing is compliance with obligations laid down by law, regulations, EU legislation, or orders of an Authority (Art. 6.1(c) GDPR).
  3. Legitimate interest purposes, such as defending the Controller's rights in the event of disputes and protecting the security of the corporate IT system and company assets. The legal basis for this processing is the legitimate interest of the Controller (Art. 6.1(f) GDPR) in protecting its rights, IT system, and company assets. If Data Subjects believe that their rights and freedoms override the legitimate interest of the Controller, they have the right to object at any time using the procedures set out in §9 below.

NATURE OF DATA PROVISION AND CONSEQUENCES OF REFUSAL

Providing data is necessary for the proper management of the pre-contractual and contractual relationship and for everything required by legal and contractual obligations. Therefore, any refusal to provide such data in whole or in part, as well as incorrect communication of mandatory information, may make it impossible for the Controller to establish and execute the contract and related accounting and tax duties properly.

PROCESSING METHODS AND TRANSFER OF DATA ABROAD

Personal data processing is carried out both on paper and using electronic tools. The Data Controller has implemented specific procedures to prevent unauthorized access, improper or unlawful use, as well as loss, alteration, destruction, or accidental loss of data. Only duly authorized personnel may access data in the performance of their duties.

For certain IT services (e.g., web cloud), the Controller may use service providers located in countries outside the European Union (EU) or the European Economic Area (EEA). The Company ensures that in such cases, the processing of personal data by these recipients complies with applicable legislation and, in particular, with appropriate safeguards as provided under Articles 45 et seq. of the GDPR, such as adequacy decisions, Standard Contractual Clauses approved by the European Commission, Codes of Conduct, Binding Corporate Rules, or other safeguards considered suitable under Art. 49 of the GDPR.

RECIPIENTS OF PROCESSED DATA

Clients' personal data may be shared, in addition to internal personnel authorized by the Data Controller for purposes connected to managing the contractual relationship (within the limits of assigned tasks and company procedures), with the following entities:

  1. Customs Agency for intra-EU supply/acquisition of goods and services
  2. Revenue Agency (Agenzia delle Entrate)
  3. Commercial partners assisting the Controller in managing services/contractual obligations (e.g., after-sales service providers, transporters, suppliers, shipyard clients)
  4. Public administrations, bodies, or authorities to whom personal data must be communicated to comply with legal/regulatory obligations, prevent abuse or fraud, or fulfill authority orders (e.g., for public tenders)
  5. Banking and credit institutions for managing payments, financing, and guarantees
  6. Professional firms and freelancers appointed to process data for legal, accounting, and tax matters related to the contractual relationship
  7. IT companies and entities tasked with maintenance, updating, and technical security of the IT system (including applications, network devices, and electronic communication networks)
  8. Certification bodies
  9. Delegated companies for electronic invoicing and compliant archiving of tax documentation

The updated list of recipients (acting as independent controllers or processors) is kept at the Controller's registered office and is available upon request by emailing privacy@pin-craft.com.

DATA RETENTION PERIODS

The Company applies the following retention periods, unless shorter or longer retention is necessary to fulfill requirements of justice (e.g., responding to court/administrative orders, exercising or defending rights in or out of court, or defending against legal actions/complaints):

  • Data processed for contractual rights and obligations: For the duration of the contractual relationship.
  • Data processed for legal obligations (retention of accounting records pursuant to Art. 2220 of the Italian Civil Code and Art. 22 of Presidential Decree 600/1973): 10 years from the termination of the contractual relationship.

RIGHTS OF THE DATA SUBJECT

Data Subjects have the right to exercise the following rights against the Data Controller:

  • Right of access (Art. 15 GDPR): Obtain confirmation as to whether or not personal data concerning them is being processed, and access such data.
  • Right to rectification (Art. 16 GDPR): Obtain without undue delay the rectification of inaccurate personal data or completion of incomplete data.
  • Right to erasure / "Right to be forgotten" (Art. 17 GDPR): Obtain without undue delay the erasure of personal data where applicable legal grounds exist.
  • Right to restriction of processing (Art. 18 GDPR): Obtain restriction of processing under conditions specified by law.
  • Right to object (Art. 21 GDPR): Object at any time, on grounds relating to their particular situation, to processing based on Art. 6.1(e) or (f), including profiling.
  • Right to data portability (Art. 20 GDPR): Receive personal data provided to a controller in a structured, commonly used, and machine-readable format, and transmit it to another controller without hindrance.
  • Right to withdraw consent (Art. 7 GDPR): Withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
  • Right to lodge a complaint (Art. 77 GDPR): Lodge a complaint with a supervisory authority, particularly in the Member State of habitual residence, place of work, or place of alleged infringement (in Italy, the Garante per la protezione dei dati personali).

Except for complaints to the supervisory authority, the above rights may be exercised by making an informal request to the Controller via mail at the address listed above or via email at privacy@pincraft.com, using the form available on the Privacy Authority website. For alleged violations or reporting on processing procedures, Data Subjects may also contact the DPO at dpo@opacmare.it.

REVISION OF THIS PRIVACY NOTICE

The Data Controller reserves the right to modify or update the contents of this privacy notice in whole or in part, including due to changes in applicable laws.


THE DATA CONTROLLER
PIN-CRAFT S.R.L.