Information on the processing of personal data

Pursuant to Article 13 of the Regulation (EU) 2016/679 (G.D.P.R. or in the English meaning G.D.P.R. (General Data Protection Regulation) on the protection of personal data and in relation to your personal data, their processing will be based by[data controller] on the principles of fairness, lawfulness and transparency, as well as the protection of your confidentiality and the protection of your rights. In connection with this we inform you of the following.

a) Data Controller
The Data Controller is OMNIA CONSULT S.r.l. with registered office in Viale Bicchierai, 129, 51016 Montecatini Terme (PT) hereinafter referred to as the “Data Controller”.
Its contact details are as follows:
email: info@tooscans.it
pec: tooscans@pec.it

b) Purposes and legal basis of the processing
The processing to which your personal data, collected at the time of registration on our websites traceable exclusively to the domain tooscans.it ( hereinafter the “Site”) or at the time of making online purchases on that website, will be subjected will be carried out for the purposes set out below.
The legal basis for the processing of personal data relating to each purpose is specified next to each of them. When consent is specified as the legal basis for processing, it is understood that the data will be processed by the Data Controller for those purposes only after collecting your consent (as “data subject”).
The legal basis concerning the execution of the contract does not require any consent and allows the owner to process the personal data provided in accordance with the contractual obligations undertaken (e.g., rendering a service or selling a product).
Finally, with regard to the indicated legitimate interests, they concern the case where:
a) the data subject has already expressed interest in the product sector in question, purchasing certain products or services, and the Controller has a specific and justified interest in continuing to send him communications in relation to services or goods similar to those purchased;
b) the Controller has an interest in processing the data subject’s browsing data in order to enable him to visit web pages.
Your personal data will be processed for the following purposes:
1. management of the Site registration procedure and filling in data collection forms
available on the Site to request information, make reports, and contact the Controller; (Legal basis for processing: Contract performance);
2. enable online purchases, with respect to the specified products and in the manner specified in the contractual conditions of sale; (Legal basis of processing: Execution of the contract);
3. sending for marketing purposes – via e-mail, postal service, social networks, sms and specific “apps”- of commercial newsletters, offers, promotions, discounts and invitations to events or events (hereinafter the “Promotions”) to customers and/or potential customers. (Legal basis for processing: consent of the data subject);
4. profiling, by reading and analyzing, through automated decision-making processes, purchasing behavior, using data related to your spending, in order to improve the commercial offer and make specific product promotions and commercial offers as closely as possible to your profile and needs, including through surveys and market research; (Legal basis for processing: Consent of the data subject);
5. sending, exclusively to the e-mail address you provided during the purchase of a product or service from the Websites, promotional messages about goods or services similar to those purchased by you, provided that you do not object to the processing in the manner indicated below, in accordance with the provisions of Article 130, paragraph 4, of Legislative Decree 196/2003 and subsequent amendments and additions -c.d. soft spam- (Legal basis of processing: Legitimate interest);
6. to allow navigation on the Websites (Legal basis of processing: legitimate interest).

c) Faculty or obligation to provide and consequences of not providing data
For all purposes, the provision of personal data is not mandatory, however, it is necessary to register and be able to make purchases on the Sites. The provision of the data present in the fields marked with an asterisk is mandatory and their non-inclusion does not allow the completion of the registration procedure By contrast, the provision of the data present in the fields not marked with an asterisk, although it may be useful to facilitate relations with us is optional and their non-inclusion does not affect the completion of the procedure.

d) Recipients or categories of recipients of personal data
The personal data related to the processing in question, for the purposes mentioned above, may be communicated:
– to those who within the organization of the Data Controller, have the need to do so as a result of the task held. Such persons are the persons authorized to process under the direct authority of the Data Controller pursuant to Article 4 No. 10 of EU Regulation 2016/679 (hereinafter referred to as “persons in charge”);
– to parties whose activities are necessary for the execution of contracts to which you are a party or to fulfill specific requests (e.g., Transporters, Suppliers of goods and services and Subcontractors both domestic and foreign within the European Union, Companies and Institutions in the banking, credit and insurance sector, Factoring Companies, Financial Intermediaries, Companies that provide business information, Correspondence Delivery Companies);
– to third parties to whom the Data Controller possibly outsources certain activities and who consequently provide the writer with certain instrumental services, however related to the processing and purposes described above, such as, for example, administrative, accounting, tax, audit, information system management, credit collection, mass storage, call center services. These third parties carry out processing on behalf of the Data Controller and are authorized to process them as Data Processors in accordance with Art 28 of the GDPR.

e) Retention Period
The Data Controller will retain registration master data and purchase accounting data for 10 years after last use. For marketing and profiling purposes, customer purchase data and master and contact data of customers and potential customers related to Promotions will be retained for 24 months and 12 months, respectively.

f) Your Rights
At any time, you may exercise, pursuant to Articles 15 to 22 of EU Regulation No. 2016/679, the right to:
(a) request confirmation of the existence or non-existence of their personal data;
(b) obtain information about the purposes of the processing, the categories of personal data, the recipients or categories of recipients to whom the personal data have been or will be disclosed, and the storage period or criterion;
(c) obtain rectification and erasure of data;
(d) obtain restriction of processing
e) obtain portability of data, i.e., receive them from a data controller, in a structured, commonly used and machine-readable format, and transmit them to another data controller without hindrance;
f) object to the processing of your personal data at any time (Art. 21). In particular, you may object to the processing of your data for the purpose referred to in point “c n.5” (c.d soft spam) by accessing your “Restricted Area” or by selecting the link on each e-mail sent by the Data Controller.
This will make it impossible for the Controller to send you communications for the purpose of promoting the direct sale of products or services similar to those you previously purchased (so-called soft spamming).
g) object to automated decision-making, including profiling (Art.22);
h) withdraw consent at any time without affecting the lawfulness of the processing based on the consent given prior to the withdrawal;
i) file a complaint with the Data Protection Authority (Art.77) if he or she believes that the processing of his or her data is contrary to applicable law.
You may exercise your rights by written request sent to:
Bicchierai Avenue, 129 51016 Montecatini Terme (PT)