INFORMATION NOTICE PURSUANT TO ART. 13 REG. EU 2016/679

Before providing us with any personal data, please read this information notice carefully to understand who we are, what data we process, for what purposes and how, and which rights you may exercise regarding the processing of your personal data.

A) Who is the Data Controller? The Data Controller is Sacar Due Srl, represented by its legal representative pro tempore, Mr. Umberto D’Adda, with its registered office and operating headquarters at Via Trieste Snc, 20821 Meda (MB), Tax Code and VAT number 02665060964, tel. 0362.325913, fax 0362.325804, email: info@sacardue.it, PEC: posta@pec.sacardue.it.

B) What data do we process, where do we collect your personal data, on what legal basis, and where do we process it? You provide us with your data by filling out the forms on the touchscreen you are using, or by requesting information about offers and products of interest to you, or by contacting us via email, postal mail, or phone at the provided contact details. Specifically, we process your personal details, contact information, email address, or any mobile phone number you may have provided by completing the form on the screen, solely to send you the product description sheet you have selected, as well as any usage, assembly, and/or maintenance instructions. This ensures that you have all the information you need to fully enjoy the products you purchase from this point of sale. We do not process any data classified as “Special” under Article 9 of EU Reg. 679/2016 – GDPR (such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, biometric data for uniquely identifying a person, genetic data, or data concerning health, sexual life, or sexual orientation), nor do we process data related to criminal convictions and offenses under Article 10 of the GDPR. Should it become necessary to process such data, we will request your prior consent. According to EU Regulation 2016/679, the processing of personal data is permitted only if one of the following conditions is met: -The user has given consent for one or more specific purposes;
-The processing is necessary for the performance of a contract with the data subject and/or for the implementation of pre-contractual measures; -The processing is necessary for compliance with a legal obligation to which the Data Controller is subject or for the protection of vital interests of the data subject or another natural person; -The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller; -The processing is necessary for the purposes of legitimate interests pursued by the Data Controller or third parties (e.g., for monitoring IT security, preventing fraud, or in the context of an employment relationship between the data subject and the Data Controller). In our case, the processing of your data is carried out to fulfill a contract or a pre- or post-contractual obligation, to respond to your information request, to ensure you fully enjoy one of our products, or to address your specific request. Your data is processed at our Seregno office, as well as at our operational headquarters in Meda. Additionally, limited to certain IT data, processing may take place at the data centers of the company managing our servers, which are located within the European Union and are subject to GDPR compliance. Please note that electronically processed data will not be transferred abroad, as we do not utilize cloud-based applications. Should we decide to adopt cloud technology in the future, we will carefully select a service provider to ensure the virtual platform resides in a country offering adequate guarantees regarding proper data processing, in accordance with the standards outlined in Article 46 of EU Reg. 2016/679.

C) Do we engage in profiling? Under EU Regulation 679/2016, profiling is defined as “any form of automated processing of personal data consisting of the use of such data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.” Profiling might include processing and analyzing information about preferences, habits, or consumer choices to group individuals into “profiles,” i.e., homogeneous groups based on behaviors or specific characteristics (e.g., customer profiling), or to evaluate habits, satisfaction levels with services, or other aspects.
We do not engage in profiling.

D) Why do we process your data? We process your personal data for the following purposes:

• To send you descriptive product sheets and user manuals or instructions for assembly, maintenance, etc., and to respond to your information requests. If you have chosen to contact us via email or phone, we process your data to respond to your queries, provide additional information about our products or services, improve our customer care function, and enhance our pre- and post-sale services.
• To comply with legal, regulatory, and EU requirements, as well as orders from supervisory authorities (e.g., tax regulations, obtaining your consent for data processing, or other requirements), to protect our rights in legal proceedings, or to conduct anonymous statistics (e.g., anonymous market surveys).
• To promote our activities through telephone contact (telemarketing and teleselling), newsletters, participation in fairs, meetings, or industry focal points, relationships with the press, direct email marketing (DEM), advertisements or banners on other information portals, advertising techniques, web funnels, promotion of partnerships, or other promotional purposes. This may also include focused and selected analyses to optimize our offerings, provided you have given explicit consent, and to improve the quality of our main customer care processes and commercial network.

In particular, regarding point D3), if you provide your consent, you can: -Stay informed about new products and services, including invitations to events, participation in surveys, and information about products and services of our commercial partners with whom we have agreements. This may also include market research and surveys, within the scope of your authorized communication of data to third parties for commercial purposes; -Receive information about products and services from other companies that we believe may interest you, provided you have given specific consent and not revoked it. Please note that Sacar Due does not engage in direct sales to customers. As such, you will not receive sales proposals or other offers through automated means, such as phone calls, SMS, MMS, fax, regular or electronic mail, videos, WAP/web banners, internet messaging, or app-based push notifications.

E) Are you required to provide consent for the processing of your data? For the processing activities described under point D1), if you want us to respond to your request or provide our support services, you must give your consent; otherwise, we cannot fulfill your request or establish any relationship with you. For the processing activities described under point D2), your consent is not required; under privacy regulations, these activities may/must be carried out by the Data Controller without the explicit consent of the data subject. For the processing activities described under point D3), consent is optional. In these cases, without your consent, we will not process your data, in compliance with GDPR and Legislative Decree No. 185/1999 regarding unsolicited communications. Please note, however, that the data you provide when purchasing our product—particularly the data entered via the touchscreen form—may be used to send you new communications regarding products and services similar to those you have already used, unless you revoke your consent pursuant to Article 130, paragraph 4, of Legislative Decree No. 196/2003 as amended by Legislative Decree No. 101/2018. In the event of revocation, it will be immediately acknowledged but will take up to 15 days to become fully effective due to the technical time required to align all the IT systems we use.

F) How do we process your data, and how long do we retain it? We process your data both manually and using electronic tools. In all cases—and especially when using electronic tools—we adopt every security measure necessary to prevent data loss, dissemination, or deletion. We retain your data only for the time required to fulfill the purposes for which it was collected. This period may vary depending on the purpose and scope: for example, we process data related to post-sales support services until such services are completed or for related activities. However, some data we acquire may be processed in an aggregated or segmented form for statistical purposes or to evaluate our services. We may retain your data for periods mandated by tax regulations or for up to ten years after the end of our relationship to protect our legal interests in judicial proceedings. In such cases, your data will no longer be accessible to our staff, but rather archived separately from actively used data, retrievable only by authorized personnel for the aforementioned purposes. For marketing purposes, we retain your data for two years from the date of registration, or longer if you continue to use our products, thereby affirming your interest in receiving updates. In any case, you may revoke your consent at any time and request to stop receiving updates from us. Rest assured that all communications will cease, as spam is not part of our policy. Similarly, unless otherwise indicated by you, we will refrain from sending communications if, after giving your consent, you register with the so-called “Do Not Call Registry.” We are committed to balancing our mutual needs by limiting the retention of your data to what is strictly necessary. Additionally, we take reasonable measures to ensure your data remains accurate, promptly correcting or deleting inaccurate information. We exclude the processing of your data whenever the objectives pursued can be achieved using anonymous data (e.g., in market research aimed at improving services). At the end of the retention period, your data will be deleted. Therefore, once this period has expired, your rights to access, deletion, rectification, and data portability can no longer be exercised.

G) To whom do we disclose your data? Your data is accessed only by our personnel responsible for handling your request or otherwise involved in pursuing the purposes outlined in section D). Within our company, your personal data may also be accessed, in their roles as data handlers or processors, by employees, collaborators of any kind (e.g., secondees, interns, subcontractors), external collaborators responsible for services and the sales network (agents, brokers, distributors), as well as individuals, companies, associations, professional firms, or internal and external structures performing support tasks or providing assistance and consultancy services to the company. This includes but is not limited to technological, accounting, administrative, legal, tax, and financial matters (e.g., legal services, IT services, shipping, document storage) and corporate control. In particular, your data will be shared with O.B.I. Italia, the owner of the point of sale where you are located, for sales support activities or other purposes related to customer assistance. For this reason, we have appointed O.B.I. Italia as our Data Processor under Article 28 of the GDPR. Should the Processor use your data for its own purposes, unrelated to mere customer assistance, it will act as an Independent Data Controller. We may also grant access to external entities, strictly for performing tasks such as hardware or software maintenance necessary for the operation of the system or the management of additional functionalities. These entities may gain access to personal data exclusively for the requested service. All parties to whom your data is disclosed are legally obligated, like us, to process it in compliance with applicable laws. Apart from the cases mentioned above, your data will not be shared with third parties unless required by law or necessary to respond to legal or judicial requests. We do not disseminate your data, meaning it will not be made accessible to an indeterminate number of individuals, nor will we disclose it to others for their purposes.

H) Your rights Please note that at any time, you have the right to:

• Obtain confirmation of the existence of personal data concerning you, even if not yet registered, and receive intelligible communication of such data.
• Obtain information regarding the origin of the personal data, the purposes and methods of processing, as well as the logic applied in cases where the processing is carried out using electronic tools.
• Receive a list of entities or categories of entities to whom the data has been disclosed or who have become aware of it as Data Processors or Handlers.
• Request the updating or correction of processed data and, in cases of unlawful processing or those outlined in Article 17 of Regulation (EU) 2016/679, request the deletion (right to be forgotten), anonymization, or blocking of the data.
• Request the restriction of data processing.
• Request, if relevant, the integration of your personal data.
• Object, in whole or in part, to the processing of your personal data for legitimate reasons, even if related to the purpose of collection.
• Object to the processing of personal data for commercial purposes or interactive commercial communication and to be informed by the Data Controller, no later than the time the data is communicated or disclosed, of your right to exercise this option free of charge.
• Receive confirmation regarding the existence or absence of automated decision-making processes, including profiling under Article 22, paragraphs 1–4 of Regulation (EU) 2016/679, and in such cases, receive information about the logic used, as well as the significance and consequences of such processing.
• Request the portability of your data to another Data Controller.
• Be notified if an event occurs that may have caused a breach of your data, provided such an event poses a high risk to your rights and freedoms, under the conditions outlined in Article 34 of Regulation (EU) 2016/679.

Requests can be sent in writing to the Data Controller’s address or via email to the contacts listed in section A) or available on our website at www.sacardue.it .

Please also note that you have the right to file a complaint at any time with the Italian Supervisory Authority (Garante della Protezione dei Dati Personali,  www.garanteprivacy.it ).