AS PER ART. 13 OF EU REGULATION 2016/679, GENERAL REGULATIONS ON DATA PROTECTION This information is provided for the website shop.gerards.com owned by C.D. s.r.l., via Stazione Vecchia, 72, 25050 Provaglio di Iseo (Brescia, Italy), acting as pro-tempore legal representative and not for other third-party websites that may be visited by the user through links. The information is intended for all subjects interacting with the web pages of the Site, both those who use the Site without registering, and those who, at the end of a specific procedure, register on the Site and use the online services provided. DATA CONTROLLER The Data Controller is C.D. s.r.l., via Stazione Vecchia, 72, 25050 Provaglio di Iseo (Brescia, Italia). PERSONAL DATA SUBJECT TO PROCESSING In addition to what stated in other pages (particularly, with reference to "Cookies"), we inform you that through the Site and the use of the related functions and/or access to the services provided therein, data may be collected and processed for the purposes specified below: -browsing data: data that the server stores automatically every time the site is visited, such as the provider name, the site from which you access the Site, the pages visited, the date and duration of the visit, the IP address of the device; - general personal and ID data: this category includes name and surname, address, e-mail address, date of birth and any other contact details provided when filling out the electronic forms, published on the Site each time; - information about the user's orders and the purchase process, such as the IP address from which the transaction originated, the time of the request, the type of browser used, as well as information about the product selected and purchased, the shipping and/or billing address, any complaints or right of withdrawal exercised in relation to the purchase made through the Site. LAWFUL BASE AND PURPOSE OF DATA PROCESSING The processing of personal data is founded on the assumption of a contractual or legal obligation or, according to circumstances and as specified in the following paragraph, on the assumption of a legitimate interest of the Company or on the user's consent, which is optional and may be withdrawn at any time, and is exclusively aimed at achieving the following purposes: (i) fulfilment of contractual obligations - to ensure registration on the Site and the correct provision of the services requested through the Site and/or through forms made available therein, and, therefore, to correctly and timely fulfil all obligations arising from pre-contractual and contractual arrangements established with you, including any requests for support and assistance for online purchases, management of returns, withdrawal or complaint. This includes administrative and accounting purposes linked and resulting from the contract stipulated with you, also with regards to the possible transmission by e-mail of commercial invoices by companies that provide the e-commerce service (including, for example, the refunding procedure of the price paid and the issue of a credit note resulting from the withdrawal and return of the purchased product); (ii) in compliance with legal obligations - for the fulfilment of obligations deriving from national and/or Community laws or regulations in force, including tax matters, as well as provisions issued by competent authorities and bodies; (iii) according to a legitimate interest of the Company consisting in the defence in court of a right or interest before any competent authority or body; to allow the direct offer by the Company of similar products or services (so-called soft spamming) to those that were the subject of a previous purchase, limited to the e-mail details provided by you in case of a previous purchase of a product and unless you oppose such processing; (iv) based on consent for sending advertising material relating to the Company's products and/or services, as well as for the detection of the level of customer satisfaction on the quality of the services provided and the activity carried out by the Company and for the performance of statistical analysis and market surveys, by email (so-called marketing purposes). MANDATORY OR OPTIONAL NATURE OF DATA PROVISION The provision of data for the purposes set out in points (i) (fulfilment of contractual obligations), (ii) (fulfilment of legal obligations) and (iii) (legitimate interest of the Company) of Article 3 above is merely optional. However, since such processing is necessary to allow registration on the Site and the provision of services offered through the Site, failure to provide the data in question, whether partial or inaccurate, will result in the inability, depending on the case, to register on the Site and to use the services provided online and, in general, to proceed with the contractual relationship established and / or to fulfil the obligations as required by the contract or by applicable law or, furthermore, to process your specific requests as well as the inability for the Company to send you generic information on products or services similar to those purchased previously, to carry out market surveys, also aimed at assessing the level of user satisfaction and thus improve its services, or in any case to pursue its legitimate interests (such as the defence of a right in court). With reference to the purposes of the processing indicated in point (iv) above (marketing consent), the provision of data is merely optional, and the related processing is based on consent, which is optional and may be withdrawn at any time. Failure to provide such data will have no consequences on the possibility of registering with the Site and using the services available therein and will only imply the refusal of receiving advertising material relating to the Company's products and/or services. Consent for the purposes described above (marketing purposes) may be withdrawn at any time. The withdrawal of consent is only valid for the future and has no effect on the processing carried out prior to it (where based on consent). In addition, limited to the purpose referred to in point (iii) of art. 2 (so-called soft-spam), we remind you that you may object to the processing of your data by sending an email to the address indicated therein. DATA COMMUNICATION Data may be shared with the following categories of subjects ("recipients"): - to all subjects (including Public Authorities) who have access to personal data by means of legislative or administrative procedures; - to all subjects, public and/or private, natural and/or legal persons to whom the communication is necessary or instrumental for the correct fulfilment of a contractual or legal obligation; - to banks and companies that manage national or international payment circuits through which online payments are made for products purchased through the Site. In addition to the aforementioned, for the pursuit of the purposes described in article 3 above, personal data may be shared with persons who provide services to the Company, such as, for example, but not limited to: - to companies or third parties in charge of printing, wrapping, shipping and/or delivering promotional-advertising material; - to companies, consultants or professionals who may be entrusted with the installation, the maintenance, updating and, in general, the management of the Site's hardware and software; - to companies or Internet providers in charge of sending documents and/or information material, - to professionals, editors, auditors, legal or tax advisors of the Company, who will treat them, as appropriate, as owners or external supervisors of the processing of personal data. Furthermore, the Company's employees and collaborators (in particular E-commerce, Marketing, Sales, Customer Care, Finance Offices), as well as the Company's shareholders and directors, may have access to the data as "authorized persons". STORING OF PERSONAL DATA Your personal data will be stored as follows: - for the marketing purposes described in point (iv) of Article 3 above for the period of time allowed by law and according to the provisions of the Guarantor for the Protection of Personal Data ( Supervising Authority) in particular, as stated in the “Fidelity card” and customer warranty provision. The Guarantor’s rules for loyalty programs" of 24 February 2005 and subsequent amendments and additions; - with the exception of what stated above, the user's data will be processed and stored for the entire duration of the contractual relationship and, subsequently, for the maximum time foreseen by the applicable laws in terms of prescription of the rights and/or termination of the action (also in the administrative-tax area) and, in general, for the exercise/defence of the Company's rights in disputes promoted by public authorities, public subjects/entities and private subjects. MINORS UNDER THE AGE OF 14 The Site does not contain any information, functions or services directly intended for users under 14 years of age. Minors must not provide information or personal data without the consent of their parents or guardians. We therefore invite all users under the age of 14 to not share their personal data under any circumstances without the prior consent of a parent or guardian. Should the Company learn that personal data has been provided by a minor (under 14 years of age), the Company will immediately destroy the data or request consent from the parent (or guardian) and reserves the right to deny access to the services available on the Site to any user who has withheld their age or who has disclosed their personal data without the consent of their parents (or guardian). INTERESTED PARTIES' RIGHTS In compliance with Regulation (EU) 2016/679, the subject has the right to (i) access the data and specific information on the processing, such as, for example, purposes, categories, the existence of the other rights indicated below and to request a copy of the data, (ii) amend the data, (iii) delete data without undue delay in the cases set out in the same Regulation, such as in case of objection to the processing and where there is no legitimate predominant interest in the processing by the Controller (this right does not apply if the processing is necessary for the fulfilment of a legal obligation or for the exercise and defence of a right in court), (iv) request to limit the processing, (v) object at any time, for reasons concerning your particular situation, to the processing based on a legitimate interest of the Data Controller, (vi) receive the data in a structured, commonly used and readable format from an automatic device (portability) and transmit them to another Data Controller in the cases provided for in the Regulation (vii) withdraw, at any time, any previous consent given. It is also the right of the data subject, if they consider that the processing of the data infringes the provisions of the Regulation, to file a complaint with the competent Regulatory Authority of the Member State where they normally live or work or of the State where the alleged infringement has occurred. To exercise the above rights, you may contact the Data Controller by sending a notification by post to the above address or by email to ordini@gerards.com. This Privacy Policy may be subject to changes and updates, also due to changes in current legislation. Any changes or updates will be notified to the user by publishing them on the home page of the Site and will be valid and binding from such time. The Company therefore invites users to visit this page periodically in order to learn about any changes or updates.