Privacy policy

Privacy Notice on the Processing of Personal Data

(Article 13 of EU Regulation 679/2016)

Pietro Romanengo fu Stefano S.r.l. (“Romanengo”) considers the protection of the personal data of users who browse and/or purchase products on its website (the “Users”) to be of fundamental importance and guarantees that the processing of personal data carried out through the website www.romonengo.shop (the “Website”) takes place in compliance with the rights of data subjects, with the provisions of European Regulation No. 679/2016 (the “GDPR”) and with other applicable national and EU provisions.

1. Who processes the User’s personal data?

The Data Controller is Pietro Romanengo fu Stefano S.r.l., with registered and operational headquarters at Via Soziglia 74/76 r, 16123 Genoa, Italy, e-mail: sabrina.zampardi@romonengo.shop.

The Data Controller may be contacted at any time using the contact details indicated above.

All Romanengo employees who have access to Users’ data will be appointed by the Data Controller as persons authorised to process personal data and will have received appropriate operating instructions in this regard.

2. What data are processed?

Romanengo collects certain personal data of Users (the “Data”), including information collected during browsing on the Website and personal data voluntarily provided by the User when purchasing products offered on the Website and/or requesting information from the Website by e-mail or through the dedicated “Contact Us” box.

For further information regarding the type and use of cookies on the Website, please refer to Romanengo’s Cookie Policy available on this Website.

Browsing data

The IT systems and software procedures used to operate the Website acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols.

This information is not collected in order to be associated with identified data subjects but, by its very nature, could, through processing and association with data held by third parties, make it possible to identify Users.

This category of data includes the IP addresses or domain names of the computers used by Users connecting to the Website, the addresses in URI (Uniform Resource Identifier) notation of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the response provided by the server (successful completion, error, etc.), and other parameters relating to the Users’ operating system and IT environment.

Data voluntarily provided by the User

Romanengo primarily collects the data necessary to complete the purchase of the products requested by the User or to contact the User in response to a request for information.

By way of example, Romanengo may collect the following Data:

1 - first and last name;

2 - address;

3 - e-mail address;

4 - tax identification number or VAT number;

5 - date of birth;

6 - gender;

7 - telephone number.

3. What are the purposes and legal bases of the processing?

Romanengo will process Users’ Data for the following purposes:

a) to enable registration on the Website, allow browsing of the Website and use of services reserved for registered users;

b) to enter into and perform contracts for the purchase of products offered on the Website;

c) to respond to requests for information sent to us by e-mail or through the dedicated “Contact Us” box;

d) to carry out direct marketing activities aimed at promoting Romanengo’s products and brand;

e) to send newsletters and periodic updates concerning products, initiatives and events organised by Romanengo, including invitations to private events;

f) to carry out statistical surveys.

The processing of Data for the purposes listed above is carried out:

1 - for the purposes referred to in points a., b. and c., in order to provide the service requested through browsing the Website (e.g. registration and creation of a reserved area, communications relating to the provision of the service), perform a contract or take pre-contractual measures requested by the User, and comply with legal obligations;

2 - for the purposes referred to in points d. and e., subject to obtaining the User’s express consent;

3 - for the purpose referred to in point f., on the basis of the Data Controller’s legitimate interest, it being understood that the User may always object to such processing.

Tracking pixels in e-mail communications

E-mail communications sent by the Data Controller, in particular newsletters and communications relating to Romanengo’s products and initiatives, may contain tracking pixels, i.e. small, normally invisible images hosted on remote servers which, when the User opens the message, enable the Data Controller to collect information relating to interaction with the message, such as whether the message was opened, the number and time of openings, the IP address, the inferred geographical location, the type of device and the e-mail client used.

These Tracking Tools are used for different purposes, corresponding to different legal bases:

Individual measurement and personalisation of informational and promotional communications: for the purpose of individually measuring interaction with informational and promotional communications, with a view to assessing and improving their effectiveness, adapting their content and frequency, and identifying the User’s interests, processing is carried out on the basis of the User’s consent pursuant to Article 122 of Legislative Decree 196/2003 (Italian Privacy Code) and Articles 6(1)(a) and 7 of Regulation (EU) 2016/679. Such consent is included in the consent given by the User to receive the communications.

Service, transactional or institutional messages: (for example, order confirmations, communications relating to shipping or payment, account management and other technical communications connected with a service requested by the User). In such cases, any use of tracking pixels is necessary for the provision of the service or compliance with legal obligations, and processing does not require consent, as it is necessary for the provision of the service pursuant to Article 122(1) of the Italian Privacy Code and Article 6(1)(b) and (c) of the GDPR.

The User may withdraw the consent given at any time, including selectively, by using the link available in the footer of each communication or by writing to sabrina.zampardi@romonengo.shop.

In particular, the User may choose:

  • not to receive any further communications; or
  • to continue receiving communications without tracking pixels.

Refusing tracking does not entail any limitation on the use of the Service.

The choices expressed by the User are recorded by the Data Controller in compliance with the principles of accountability and privacy by design and by default set out in Article 25 of the GDPR.

The service used to send communications and for the related tracking is Klaviyo.

The Data Controller adopts appropriate technical and organisational measures to reduce the risk of Users being identifiable.

4. What are the consequences of failure to provide the Data?

Except as specified with regard to browsing data, Users are free to provide or not provide Data in the various sections of the Website for the purchase of products available on the Website or by sending a request for information to the Website by e-mail or through the dedicated “Contact Us” box.

The provision to Romanengo of the User’s Data requested on the various occasions on which data are collected may, in certain cases, be essential for pursuing the purposes identified in this Privacy Notice.

If the User refuses to provide the Data requested for the purposes listed in Article 3, points a., b. and c., Romanengo will be unable to provide the User with the products or respond to the User’s requests.

The provision of Data for the purposes listed in Article 3, points d. and e., requires the User’s express consent pursuant to the GDPR.

With regard to the purposes listed under points d. and e. above, consent given for the sending of commercial and promotional communications by electronic means shall also be deemed to cover traditional methods of contact.

If the User refuses to provide the Data requested for the purposes listed under points d. and e. above, the consequence may simply be that Romanengo is unable to carry out the activities indicated therein and, consequently, that the User is unable to receive commercial information and updates concerning Romanengo’s activities.

5. How is the processing carried out?

The processing of Data shall be carried out in accordance with the principles of lawfulness, fairness, transparency, proportionality and data minimisation.

It may also be carried out through automated procedures designed to store, manage and transmit the Data and shall take place using appropriate tools which, insofar as reasonably possible and in accordance with the state of the art, guarantee security and confidentiality through suitable procedures designed to prevent the risk of loss, unauthorised access, unlawful use and disclosure.

6. Who are the recipients of the Data?

In addition to Romanengo’s employees and/or collaborators, the Data may be disclosed to:

a) Romanengo’s tax consultants;

b) Romanengo’s IT consultants and providers of electronic/technological services;

c) Romanengo’s legal consultants;

d) courier companies for the delivery of purchased products;

e) competent authorities;

f) persons who may access the Data pursuant to provisions of law or secondary or EU legislation.

The updated list of recipients may be obtained by writing to: sabrina.zampardi@romonengo.shop.

The Data will not be disseminated or made publicly available.

7. Where are the Data processed?

The Data will be processed within the European Economic Area.

8. How long are the Data retained?

The Data will be stored in electronic format and retained for the period strictly necessary to comply with legal and contractual obligations.

In this regard, it is specified that the Data:

  1. necessary to process requests will be retained for the period strictly necessary to process the request, where such request does not result in a contractual relationship;
  2. necessary to ensure Romanengo’s compliance with legal obligations (e.g. accounting and tax regulations) will be retained for the period specified by the applicable legislation;
  3. necessary for Romanengo to perform any contracts entered into with the User will be retained for the entire duration of the contract and for the period necessary to enable Romanengo to defend its rights in the event of disputes relating to the contract entered into with the User (6 months after expiry of the limitation period provided for by law);
  4. necessary to carry out the activities indicated in Article 3, points d. and e., will be retained until the User withdraws their consent;

necessary to carry out statistical surveys will be retained until the User objects to the processing.

9. What are the data subject’s rights?

The User has the right to request from the Data Controller:

confirmation as to whether or not Data concerning them are being processed and, where that is the case, access to the Data and to the information referred to in Article 15 of the GDPR (purposes of processing, categories of data, categories of recipients, data retention period);

  1. rectification of inaccurate Data;
  2. completion of incomplete Data;
  3. erasure of the Data, in the cases provided for by law;
  4. restriction of the processing of the Data, allowing, in the cases provided for by law, the User to obtain the marking of stored personal data with the aim of limiting their processing in the future;
  5. receipt of the Data in a structured, commonly used and machine-readable format and transmission of such Data to another data controller (so-called data portability);
  6. withdrawal of consent where consent has been given;
  7. objection, in whole or in part, to the processing of the Data, where permitted by law;
  8. not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them;
  9. lodge a complaint pursuant to Article 77 of the GDPR with the national supervisory authority of the EU Member State in which the User has their habitual residence or place of work, or where the alleged infringement of their rights has occurred. Where that State is Italy, the relevant authority is the Italian Data Protection Authority (Garante per la protezione dei dati personali).

It is specified that the User’s right to object to the processing of Data for the purposes listed in Article 3, points d. and e., carried out through automated means of contact, also extends to traditional means of contact. The User may also exercise this right selectively, for example by objecting only to the sending of promotional communications through automated means.

These rights may be exercised by contacting Romanengo using the contact details indicated in Article 1 of this Privacy Notice.

10. Third-party websites

This Privacy Notice applies to Users’ personal data collected through the Website. It does not apply to other websites owned by third parties which may be accessed through links available on the Website.

Romanengo cannot be held responsible for the content of such websites or for the rules they adopt, including with regard to Users’ privacy and the processing of their personal data while browsing such websites.

Users are therefore invited to exercise caution when accessing such websites through links available on our Website and to carefully read their terms of use and privacy policies.