The artist SantaSeveso, based in Milan, Via Carlo Farini 59, as Data Controller of your personal data, pursuant to and for the purposes of EU Regulation 2016/679 hereinafter "GDPR", hereby informs you that the processing of personal data carried out by the same will be based on principles of correctness, lawfulness, transparency, minimization and that your personal data will be processed in accordance with the legislative provisions of the aforementioned legislation and the confidentiality obligations set forth therein.

1. Object and purpose of the treatment.

The Data Controller processes personal identification and contact data (such as, for example, name, surname, address, telephone number, e-mail address), hereinafter "Data" or "Personal Data", communicated by you in the pre-contractual phase, on the occasion of the execution of contracts or on the occasion of events or promotional activities organized by the Data Controller in which you participated.

2. Legal basis of the treatment

Your Data is processed in order to communicate to you the realization of events and/or promotional activities of products and/or services rendered by the Owner (articles of art and related accessories under the SantaSeveso brand, hereinafter also "Products").

The legal basis of this processing is the legitimate interest of the Data Controller (art. 6, paragraph 1, letter f GDPR), who, having received your Data from you (and expressed interest in the Products) has reason to believe that there is an interest on your part to receive invitations or news relating to the Products or to events and/or activities relating to the world of design/furniture promoted by the Owner.

The provision of your data is optional. However, any non-communication, or incorrect communication of the Data will make it impossible for the Data Controller to carry out its invitation and/or promotion activity.

3. Processing methods.

The treatment will be carried out in an automated and/or manual form, in compliance with the provisions of art. 32 of the GDPR 2016/679 and through the adoption of the appropriate security measures envisaged and, in particular, by respecting the principles of lawfulness, correctness and transparency, purpose limitation, minimisation, integrity and confidentiality.

Specific security measures are observed to prevent, in addition to unauthorized access, also their loss and illicit or incorrect use.

4. Communication.

We inform you that your personal data will not be disclosed, transferred to third parties and will not be communicated without your explicit consent, except for communications necessary for the performance of the indicated purpose.

In particular, we inform you that your personal data may be disclosed to:

collaborators and/or employees of the Data Controller, trained and authorized, within the scope of their duties;

IT service providers and the company that organizes the service for sending invitations to events.

A complete list of external managers is available at the headquarters of the Data Controller at the request of the interested party.

Without express consent being required, the Data Controller may communicate your identification data to Supervisory Bodies and Judicial Authorities, as well as to all other subjects to whom the communication is mandatory by law.

5. EXTRA EU transfer and retention period.

Your personal data will not be transferred to non-EU countries and your data will be kept for a period of time equal to 5 years.

6. Rights of the interested party.

Among the rights granted to you by the GDPR are those of:

request access to your personal data and information relating to them; updating, rectification of inaccurate data or integration of incomplete data; the cancellation of your Personal Data (upon the occurrence of one of the conditions indicated in article 17, paragraph 1 of the GDPR and in compliance with the exceptions provided for in paragraph 3 of the same article); the limitation of the processing of your personal data (in the event of one of the hypotheses indicated in article 18, paragraph 1 of the GDPR);

request and obtain from the Data Controller - in cases where the legal basis of the processing is the contract or consent, and the same is carried out by automated means - your personal data in a structured format and readable by automatic device, also for the purpose of communicating such Data to another Data Controller (so-called right to the portability of Personal Data);

oppose at any time the processing of your personal data in the event of the occurrence of particular situations that concern you;

withdraw consent at any time, limited to cases in which the processing is based on your consent for one or more specific purposes and concerns common personal data (for example date and place of birth or place of residence), or particular categories of data ( for example Data revealing your racial origin, political opinions, religious beliefs, health status or sex life). The processing based on consent and carried out prior to the revocation of the same, however, retains its lawfulness;

propose a complaint to a supervisory authority (Authority for the protection of personal data - www.garanteprivacy.it) or to appeal to the Judicial Authority through an appeal pursuant to art. 140 bis Privacy Code post Legislative Decree 101/2018

8.  Owner.

 The Data Controller, pursuant to the Law, is the sole proprietorship Simona Seveso, in the person of its Owner, based in Milan, Via Carlo Farini 59.

An updated list of internal contact persons, of data processors appointed by the Data Controller pursuant to art. 28 EU Regulation 679/2016, is available at the registered office of the Data Controller.

For any communication relating to the exercise of the rights of the interested party, the Data Controller makes the following e-mail address available: santaseveso@gmail.com

Communications can also be sent by post to the following address:

Simona Seveso, via Carlo Farini 59, 20154 Milan Italy.