This policy describes the information we process to provide our services or to ensure the best possible service to our customers.

INTRODUCTION

The proper management of your data and the trust you place in our products and services are our priority. To give you the best in everything we do, we are committed to continuous improvement. With this in mind, we wish to provide you with comprehensive and transparent information on how we process and protect your personal data.

This document (the “policy”) is intended to provide information exclusively regarding the processing of information relating to users who use the services of the Ars Artist Ceccarelli website accessible at https://arsartisceccarelli.com.

This data will be collected and processed by Ars Artist Giorgio Ceccarelli and/or other identified parties for the purposes indicated below.

This Policy, in particular, is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and applies exclusively to the aforementioned website: therefore, it does not apply to any other websites that the user may access via links on it.

1. The Data Controller and Data Processor The Data Controller and Data Processor is Giorgio Ceccarelli (Ars Artist).

2. What data we process

The Data Controller collects and/or receives information concerning the Data Subject, such as: Personal identification data Name, surname, physical address, nationality, province and municipality of residence, landline and/or mobile telephone number, tax code, email address(es), social network contacts Social network data of companies, associations, public bodies, freelancers Company name or VAT number, VAT number, tax code, registered and administrative office, Name and Surname of Contact Persons, Address(es), contact person’s email address, telephone number(s), social network contacts Traceable traffic data Logs, IP address of origin, general statistical data, social network connection data

The Data Controller does not require the Data Subject to provide so-called “personal data”. “Special categories of data” means, as provided for by the GDPR (Article 9), personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data intended to uniquely identify a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

3. Why we need your data The data we request from you is used for the following purposes:

  • to process the registration request and the contract for the provision of the selected Service and/or purchased Product

In this case, we need to process the Data Subject’s personal data to add you to our customer list and to comply with legal obligations. This data will also be used to send invoices or other documents necessary for the proper performance of our role as a service or product provider. This data will be entered into our management database and will be used solely and exclusively to follow up on our collaborative relationship with the interested party.

  • manage and execute contact requests submitted by the interested party and provide assistance.

This data is processed upon your explicit request and consent to respond to your questions. This data is processed only following a request from the interested party. The legal basis for such processing is the fulfillment of the services related to the request for registration, information and contact, and/or the sending of informational material, and compliance with legal obligations.

  • Providing suggestions on additional activities relating to Services/Products similar or complementary to those purchased by the interested party (Article 47 of the GDPR)

The data controller, even without the explicit consent of the interested party, may use the contact information provided only for Services/Products similar to those being sold, unless the interested party explicitly objects.

  • Providing suggestions on additional activities other than the services/products purchased

In this case, the data will be processed only and exclusively if the Data Subject has provided consent. Processing may take place through automatic email, text message, or telephone contact systems.— !!! Identification data not provided (Art. 13 GDPR) !!! — If the Data Subject does not provide the identification data necessary to follow up on requests received or following the completed form, the Data Controller will not be able to proceed with the processing related to the management of the requested services and/or the contract and the Services/Products connected to it, nor with the obligations that depend on them. — Consent denied for uses other than those related to managing the contractual relationship —  If the data subject does not consent to the use of their data for the purpose of receiving information or specific information on promotional activities, consent remains valid for the performance of those activities necessary to manage the contractual relationship.

The data provided by the data subject will not be disclosed to third parties.

4. How we collect data. The Data Controller collects personal data in several ways:

  • Through automatic data collection systems that track information on our website navigation in an aggregate manner. We use this information to perform statistics and analyze all those interested in our services. This information may also be collected through software or plugins external to our website (so-called “Cookies” –> See point 9 of this text)
  • Through forms that the site user can freely decide to leave to be contacted or informed
  • Through forms necessary for our e-commerce site to better carry out our online sales activities
  • Through forms for collecting quote requests
  • Through one-on-one meetings at trade shows, events, initiatives, or contacts

Explicit consent is requested in all these methods. In the case of offline data collection, consent will be countersigned; in the case of online data collection, consent occurs when the “Submit” link (or similar words) is clicked.

5. Where this data is stored The data processed is stored in two ways:

  • The data collected through our website will be entered into a database on the website and on servers provided by Aruba Business srl (Read the Aruba Business privacy policy here https://business.aruba.it/informativa_arubabusiness.pdf)
  • The data collected offline will be stored in dedicated folders located at our company’s registered office or operating headquarters.

6. How is this data protected?

  • Data collected by the website

The data we collect through the website is protected by passwords reserved for website administrators only. The website has two protection systems. The first is a website encryption system using the https protocol. The security certificate is provided by Let’s Encrypt, a company owned by Aruba Business Spa. The second is a website protection system provided by WordFence, which:

  1. Prevents access by any unauthorized person
  2. Blocks access if “banned” passwords are used because they are considered “hacked”
  3.  

The data is all stored on Aruba Business Spa servers.

  • Data collected offline

The data collected offline is all stored in dedicated folders located within the company headquarters. The company is always manned during designated working hours, while during closing hours it remains closed and accessible only with an access key. The folder in which the data is stored is anonymized.

7. How long do we retain the data? In general, the Data Subject’s personal data will be retained for as long as necessary for the legitimate purposes for which it was collected, unless there are legitimate and specific requests for deletion. In particular, they will be retained For 20 years in the case of personal data collected for the purpose of carrying out activities related to or similar to the services or products sold. However, in the case of data provided to the Data Controller for the purposes of commercial promotion for services other than those already acquired by the Data Subject, for which the Data Subject initially provided consent, these will be retained for 48 months, unless the consent given is revoked. Regardless of the Data Subject’s determination to remove them, personal data will in any case be retained according to the terms established by current legislation and/or national regulations, for the exclusive purpose of ensuring the specific fulfillment of certain Services (for example but not limited to Certified Email, Digital Signature, Substitute Storage – in this regard, see the relevant section). Furthermore, personal data will in any case be retained for the fulfillment of obligations (e.g., tax and accounting) that remain in force even after the termination of the contract (Article 2220 of the Italian Civil Code); For these purposes, the Data Controller will retain only the data necessary to achieve the relevant purposes. This does not apply to cases where rights arising from the contract and/or registration must be asserted in court, in which case the Data Subject’s personal data, exclusively those necessary for these purposes, will be processed for the time necessary to achieve them.

8. Rights of the Data Subject (Articles 15–20 GDPR) The data subject has the right to obtain from the data controller, upon request, the data held by the Data Controller relating to the data subject (so-called right to data portability). Furthermore, the data subject may request deletion from any database or other data storage location, or the correction of some of this data, at any time and without having to provide any justification for such request. For any information or needs, the interested party may contact the Data Controller or the Data Processor directly at the contact details provided in point 1 of this document. The maximum timeframe established by law for the Data Controller to process requests in this regard is 1 month. The interested party may also lodge a complaint with the competent supervisory authority in Italy (Italian Data Protection Authority), or with the authority performing its duties and exercising its powers in the Member State where the GDPR violation occurred.

9. Cookies and services provided by third parties The Data Controller uses third parties to perform certain functions and activities specifically requested by third parties. In particular, our Hosting, Database, and Email services associated with the purchase of domains and websites are provided by Aruba Business srl. These services are therefore provided through this provider, whose Privacy Policy can be viewed at this link: https://business.aruba.it/informativa_arubabusiness.pdf. This operator was chosen for its specific characteristics of reliability, security, and service. In other cases, we may use servers and services (hosting, databases, and email) provided by other providers. In this case, the Data Controller will inform the Data Subject of the specific choice of provider. If the Data Subject wishes to exercise their rights regarding the information contained within these servers, they are entitled to do so and may directly contact the contact persons indicated in point 1 of this Privacy Policy. The following cookies are present on our website.

  • General information on cookie management

Cookies are data sent from the website and stored by the internet browser on the user’s computer or other device (e.g., tablet or mobile phone). The interested party can manage and disable cookie settings directly from their browser. Below you can see how to manage cookies in the most popular browsers:

Technical cookies and third-party cookies may be installed on our website or its subdomains. In any case, the user can manage, or request the general deactivation or deletion of cookies, by changing the settings of their internet browser. However, deactivating cookies may slow down or prevent access to some parts of the site. Three types of cookies: technical cookies, third-party cookies, profiling cookies

  • Technical cookies

These are all cookies that allow the safe and efficient use of our website. Technical cookies are essential for the proper functioning of our website and are used to allow users to navigate normally and take advantage of the advanced services available on our website. The technical cookies used are divided into session cookies, which are stored exclusively for the duration of the browsing session until the browser is closed, and persistent cookies, which are stored in the user’s device memory until they expire or are deleted by the user.

  • Third-party cookies

Introduction

Other types of cookies or third-party tools that may use them

Some of the services listed below collect aggregate statistics and may not require the User’s consent or may be managed directly by the Data Controller – as described – without the assistance of third parties. If the tools listed below include services operated by third parties, these may—in addition to what is specified and even without the Data Controller’s knowledge—track the User. For detailed information, please consult the privacy policies of the listed services.

Interaction with social networks and external platforms

These services allow interaction with social networks, or other external platforms, directly from the pages of this Application. The interactions and information acquired by this Application are in any case subject to the User’s privacy settings for each social network. If a social network interaction service is installed, it may collect traffic data relating to the pages on which it is installed, even if Users do not use the service.

Google+ +1 button and social widgets (Google Inc.) The Google+ +1 button and social widgets are services for interacting with the Google+ social network, provided by Google Inc. Personal data collected: Cookies and Usage data. Place of processing: USA – https://policies.google.com/privacy?hl=it

Facebook Like button and social widgets (Facebook, Inc.) The Facebook Like button and social widgets are services allowing interaction with the Facebook social network, provided by Facebook, Inc. Personal data collected: Cookies and Usage data. Place of processing: USA – www.facebook.com/privacy/explanation

Tweet button and Twitter social widgets (Twitter, Inc.) The Tweet button and Twitter social widgets are services allowing interaction with the Twitter social network, provided by Twitter, Inc. Personal data collected: Cookies and Usage data. Place of processing: USA – www.twitter.com/privacy

Google Analytics (Google Inc.) Google Analytics is a web analytics service provided by Google Inc. (“Google”). Google uses the Personal Data collected for the purpose of tracking and examining the use of this Application, compiling reports and sharing them with other services developed by Google. Google may use the Personal Data to contextualize and personalize the ads of its own advertising network. Personal data collected: Cookies and Usage data. Place of processing: USA – https://policies.google.com/privacy?hl=it The user can selectively disable the actionGoogle Analytics by installing the opt-out component provided by Google on your browser. To disable Google Analytics, please refer to the link below: http://tools.google.com/dlpage/gaoptout?hl=it

Google Maps Widget (Google Inc.) Google Maps is a map visualization service managed by Google Inc. that allows this Application to integrate such content within its pages. Personal data collected: Cookies and Usage data. Place of processing: USA – https://policies.google.com/privacy?hl=it&gl=it

YouTube (Google Inc.) YouTube is a map visualization service provided by Google Inc. that allows this Application to integrate such content within its web pages. Personal data collected: Cookies and Usage data. Place of processing: USA – https://www.youtube.com/intl/it/yt/about/policies/#community-guidelines Instructions for managing or disabling cookies: https://support.google.com/accounts/answer/61416?hl=it

Facebook Pixel (Facebook Ireland Limited) The Facebook Pixel is a widget that allows the tracking of visits and user activity on the website when accessing the Facebook app. This widget allows you to analyze data in aggregate form and create targeted advertising campaigns. Personal data collected: Cookies and Usage Data. Place of processing: Ireland. To set your privacy settings on Facebook differently, simply click here https://www.facebook.com/help/325807937506242

  • Profiling Cookies

Profiling cookies may be installed by the Data Controller(s) using web analytics software. These cookies are used to prepare detailed, real-time analysis reports on information about: website visitors, search engines from which they originate, keywords used, language used, and most visited pages. They may collect information and data such as IP address, nationality, city, date/time, device, browser, operating system, screen resolution, navigation source, pages visited and number of pages, duration of visit, and number of visits.

Without prejudice to the foregoing, the Data Controller informs the User that they can use Your Online Choices from this link: http://www.youronlinechoices.com