The company NORTHWAVE S.r.l., whose registered office is at Onigo di Pederobba (TV), via Levada n. 145, VAT nr. 01572560991, as personal data Controller (hereinafter referred to as “NORTHWAVE” and/or “Controller”), as defined by applicable law, whose contact details are:
Tel. +39 0423 2884,
1. Purpose and legal basis for the processing that NOT request the explicit consent fo the data subject – Mandatory nature of data provision
Your personal data shall be processed for the following purposes:
a) to enter into and to perform an agreement concerning products and/or services offered by NORTHWAVE and to satisfy your after-sales demands regarding products and/or services purchased;
b) fulfilment of tax or accounting obligations;
c) for the customer management (customer administration, agreements administration, purchase orders, shipments, invoices);
d) to establish, exercise or defend a rights in a legal claims, in an administrative claims, during an arbitration process or a conciliation procedure, in the cases listed by laws, regulations or European legislation;
e) to compliance with obligations under the law, regulations, European legislation or an order of the public authority.
The processing indicated on the previous points a), b), c), d), e) is necessary for the performance of the service requested by the user. NORTHWAVE doesn’t have any obligation to acquire explicit consent to process personal data, as the legal basis for the processing of your personal data for the aforementioned purpose is art. 6 (1)(b) of GDPR (“[...]processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract”) and the art. 6 (1)(c) of GDPR (“processing is necessary for compliance with a legal obligation to which the controller is subject”);
2. Purpose and legal basis for the processing that request the explicit consent of the data subject – Optional nature of data provision
With your prior consent, your personal data may be processed by NORTHWAVE for the following purposes:
f) marketing: through sending newsletter or e-mail to propose offers and marketing initiatives relating to NORTHWAVE products and/or services. The processing of personal data for this purpose will be possible exclusively with the explicit consent of the data subject, pursuant to the art. 6(1)(a) of GDPR. The data subject shall have the right to withdraw his/her consent at any time as described on point 6 or through the erasure link contained in every e-mail. The refusal to provide or the withdrawal of consent shall not affect the execution of the agreement.
g) customer satisfaction: the processing activities aimed at collect information on your purchasing experiences.
The processing of personal data for this purpose will be possible exclusively with the explicit consent of the data subject, pursuant to the art. 6(1)(a) of GDPR. The data subject shall have the right to withdraw his/her consent at any time as described on point 6 or through the erasure link contained in every e-mail. The refusal to provide or the withdrawal of consent shall not affect the execution of the agreement. Referring to the marketing activity and customer satisfaction, the refusal of data subject explicit consent to the processing shall forbid NORTHWAVE to carry out these activities, but shall non affect the execution of the activities consequent to the agreement. The data subject shall have the right to withdraw his/her consent at any time; the withdrawal shall not affect the execution of the obligations deriving by the agreement. The data may not be used for profiling activities.
3. Recipient or categories of recipients of personal data
Personal data may be disclosure, limited to what is necessary, to the following categories of recipients:
1) people authorised, appropriately trained by the Controller, to process the personal data, who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
2) third parties personnel who provide services to the Controller and who process personal data on behalf of the Controller as Data Processor, such as:
- companies or specialists, that provide assistance activities and advisory services in legal, administrative, tax, accounting or financial matters with which the Controller is entered into an agreement pursuant and in accordance with the provisions of art. 28 of GDPR;
- third companies that manage blog and/or marketing campaigns, with which the Controller is entered into an agreement pursuant and in accordance with the provisions of art. 28 of GDPR;
3) company by which Controller is controlled and/or companies associated; Personal data may be disclosure to competent Courts, if it is required by applicable law. Referring to the subjects indicated on points nr. 1 and 2 only the category of recipients is indicated, as it is frequently reviewed and updated. Data subjects may request the updated list of recipients from the Controller through the aforementioned contacts.
4. Transfer of personal data to a third country
Your personal data may be sent abroad, within and/or outside of the European Community. NORTHWAVE ensures that the recipients shall process your paper and electronic personal data in accordance with the provisions of the applicable law and pursuant to the art. 45 (Transfers on the basis of an adequacy decision) and 46 (Transfers subject to appropriate safeguards) of GDPR.
5. Period for which the personal data will be stored
Personal data will be stored for the period strictly necessary to fulfil the purposes of the processing for which data subject has given his/her explicit consent:
- for the purposes indicated on point 2 a), b), c), d) e), for the period necessary to fulfil the obligations deriving from the agreement, anyway no more than 10 years from the collection of your data to fulfil obligations deriving from applicable law, and no more than the expiration of the period of limitation of the rights set by laws.
- for the purposes listed in point 2 f), g), for 24 (twenty-four) months from the date in which the data subject has consented to processing.
6. Processing methods
Pursuant to the art. 12 and subsq. of the applicable law, NORTHWAVE informs you that the personal data that you supply by your own shall be registered, be processed and be kept in paper and electronic archives, in accordance with appropriate technical and organisational measures as indicated in the art. 32 of GDPR. Processing of personal data is any operation or set of operations as indicated on art. 4.1, point 2 of GDPR. The processing of personal data shall be made through the use of suitable instruments and procedures to guarantee the security and confidentially of these data; it can be carried out directly or through third parties, both manually with paper supports and with electronic instruments. For the proper handling of contractual arrangements and for the compliance to legal obligations, the data can be inserted in the Controller’s internal documentation and, if it is necessary, on statutory books and records.
7. Rights of Data Subject
Pursuant to the article 15 and subsq. of GDPR, data subject has the right to ask to NORTHWAVE, in every moments, the access to his/her personal data, the rectification or the erasure of the same, the restriction of processing concerning the data subject in the cases listed in art. 18 of GDPR or to object to processing in the cases listed in art. 21 of GDPR, or to receive his/her personal data in a structured, commonly used and machine-readable format, in the cases listed in art. 20 of GDPR. NORTHWAVE makes available in its website the form that you can use to obtain the access to your personal data.
You may exercise your rights by sending a request to the Controller at the following mail address: firstname.lastname@example.org The data subjects’ requests shall be managed without undue delay and in any event within one month of receipt of the request; that period may be extended by two further months where necessary, taking into account the complexity and number of the requests.
Data subject has the right to lodge a complaint with the competent supervisory authority (Data Protection Authority), in accordance with the provisions of art. 77 of GDPR, if the data subject believes that the processing of personal data relating to him/her infringes the applicable law.