EYESOPHY

This information to data subject governs the processing of personal data by using the website available at https://www.eyesophy.com/, performed by Sofiamar S.r.l., with headquarters in Milano, Via Paleocapa 6, email [email protected] (hereinafter the “Data controller”), complying with the existing legislation on the protection of personal data, including, in particular, Regulation (UE) n. 2016/679 (hereinafter the “GDPR”).

1. Identity and contacts of the data controller

The Data controller is Sofiamar S.r.l.

As the Data controller is established in the Italian territory, no representative has been appointed.

2. Contact details of the data protection officer of the data protection

The Data controller has not appointed a data protection officer.

3. Modalities for the processing

3.1 Cookies and environmental data

3.1.1 TECHNICAL COOKIES

• Browsing, functional and session cookies: they allow the website to work correctly. The use of the so-called session cookies (that are not persistently stored on the device of the data subject and automatically deleted when the web browser is closed) is strictly limited to the transmission of identifiers of individual sessions. Session cookies shall be used for the purpose of allowing a safe and efficient navigation of the website.

Statistical cookies: the website uses statistical cookies directly created by the data controller or provided by third parties. In the latter case, appropriate tools to reduce the identifying power of the statistical cookies have been adopted, also by masking significant portions of the processed IP addresses. Moreover, the use of such statistical cookies provided by third parties has been subordinated to contractual constraints which oblige the third providers to use the same cookies exclusively for the provision of the service, to store the same separately and not to “enhance” or “cross” the statistical cookies with further information that they already have. In any case, the Data controller does not allow suppliers to use cookies for purposes other than the ones above listed.

With specific regard to the cookies of Google Analytics, the information derivable by the cookies about the use of the website by the users will be transmitted by the browser of the data subject to Google Inc., with headquarters at 1600 Amphitheatre Parkway, Mountain View, CA 94043, U.S.A., and stored on the servers of the latter.

The rules concerning privacy of Google, that you should examine, are available at the following address: http://www.google.com/intl/it/privacy/privacy-policy.html

The information to data subject concerning the services of Google Analytics is available at the following address: http://www.google.com/intl/en/analytics/privacyoverview.html

Navigation data and environmental variables: the information systems and the procedures for running of the website automatically acquire, during the normal course of operation, some personal data relative to the navigation of the data subject, including the environmental variables. This category of data includes, for example:

IP addresse of the computers used by the users who benefit from the service;

The number of the accesses; 

The pages viewed; 

The date and the hour of the access; 

The URL of the browser before visiting the website of the Data controller; 

The type of browser used for the navigation; 

The operating system used. 

3.1.2 NON-TECHNICAL COOKIES

Profiling cookies: the website does not use profiling cookies.

Erase and disable cookies

The cookies are common text files. Therefore, you can access to the same using a word processing programs. In any case, you can configure your browser in order to prevent it from processing the cookies.

Erase/disable the cookies through Firefox:

http://support.mozilla.com/it/kb/Eliminare%20i%20cookie

Erase/disable the cookies through Edge:

https://support.microsoft.com/it-it/help/4027947/windows-delete-cookies

Erase/disable the cookies through Chrome:

http://support.google.com/chrome/bin/answer.py?hl=it&answer=95647

3.2 Data provided voluntarily by individuals

The data voluntarily and freely provided by the data subject, by sending email to the addresses available on the website, could be used for the purposes indicated on a case-by-case basis.

In particular, in addition to the email address necessary to reply to the sender, any further data indicated in the same communication shall be processed. The data subject is invited not to insert special categories of personal data (for example, data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, as well as genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation) in the communications to be sent to the Data controller.

The data collected will be stored and processed exclusively for the conservation of the correspondence and will in no case be used for further purposes.

4. Purpose of the processing and relative legal basis

In relation to the technical cookies as referred to in point 3.1.1 and the navigation data, data subject’s personal data are processed for the purpose to allow the proper use of the website; this use is require to surf on the website https://www.eyesophy.com/. In this case the legal basis for processing is the legitimate interest of the Data controller.

In relation to the non-technical cookies as referred to in point 3.1.2, the processing of personal data, made through the same, allows data subject to receive a personalized browser experience based on profiling. In this case the legal basis for the processing is the consent expressed by the data subject.

In relation to the data voluntarily provided by email, the processing of the personal data allows to answer to the requests of the data subjects. The legal basis of this processing is the legitimate interest of the Data controller to reply to the data subjects’ requests.

5. Modalities to express the consent

The consent to personal data processing by non-technical cookies could be given:

• by clicking a specific box available in a banner.

In any case, the Data controller reserves to require from the data subject the relative, free, consent to personal data processing before initiating a specific processing activity requiring the data subject’s consent.

6. Source of the personal data

Data controller processes only personal data provided by the data subject in compliance with this information to data subject and collected by the website or by the email sent by the data subject.

Data deriving from public sources will not be processed.

7. Recipients and categories of recipients of personal data

Recipients of the data subject’s personal data may be:

• Communication companies that carry out commercial communication and profiling activities on behalf of the Data controller and are responsible for the processing;

The companies that offer services of an information society, including, in particular, those offering hosting services.

8. Categories of data

The data subject’s personal data will be processed. The personal data belonging to the special categories pursuant to the Article 9 of GDPR will not be processed.

9. Transfer of data

The Data controller may intend to transfer personal data to a third country or to an international organisation. Such subjects may be represented, for example, by:

• Communication companies that conduct communication activities on behalf of the Data controller;

The companies that offer services of an information society, including, in particular, those offering hosting services;

Suppliers of communication services.

The transfer of personal data to the aforementioned subjects, if based in a third country or international organization, is carried out according to a decision of suitability of the European Commission, which evaluates how the third country, the territory or one or more specific sectors in the third country or the international organization ensure an adequate level of protection of the data subject’s rights. In the absence of such decision, the Data controller – if deemed in any case appropriate – reserves itself the right to conclude specific separate agreements that oblige such subjects to adopt adequate security and also organizational measures, in order to offer appropriate guarantees related to the data subject’s rights. In particular, Google Inc. is contractually bound to ensure appropriate guarantees to the data subject’s rights. The data may be transferred to the following countries: United States of America. In order to obtain a copy of such data or the place where they have been made available a request may be sent to the following email address: [email protected].

10. Personal data retention period

The personal data processed and retained for the purposes indicated in this information to data subject are processed and retained as long as the data subject withdraws the previous consent.

Where necessary, the Data controller reserves the right to require from the data subject the renewal the consent to the personal data processing and/or the verification of the consents already given.

11. Optional nature of the consent and consequences in case of lack of consent

In relation the personal data, processed by technical cookies for the purpose to allow the proper use of the website, the communication of the personal data is not based on contractual obligations, but on a legitimate interest of the Data controller, because the website will not be available and correctly operate without this processing.

The consent to the processing of non-technical cookies shall be considered facultative. In this case, the lack of the communication of those data will determine the impossibility to furnish a customized service.

In relation to the data voluntarily provided by email, the personal data processing is not based on a contractual obligation, but on a legitimate interest of the Data controller in replying to the data subject; in case of the lack of this processing, it will be impossible to reply to data subject’s requests.

12. Rights of data subject

12.1 Right to object

The data subject has the right to object to processing him or her personal data, at any time, on grounds relating to his or her particular situation, according to point (e) or (f) of Article 6(1) of the GDPR, including profiling based on those provisions. The Data controller shall no longer process the personal data unless the Data controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

12.2 Other rights

The Data controller shall also inform the data subject about the existence of his or her following rights:

• Right of access by the data subject: the data subject shall have the right to obtain from the Data controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and other specific information, pursuant to article 15 of the GDPR;

Right to rectification: the data subject shall have the right to obtain from the Data controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement, pursuant to article 16 of the GDPR;

Right to erasure, including the right to withdraw the consent: the data subject shall have the right to obtain from the Data controller the erasure of personal data concerning him or her without undue delay and the Data controller shall have the obligation to erase personal data without undue delay; the data subject shall have also the right to withdraw the consent, where the grounds set out in Article 17 of the GDPR apply; in that case, the right to withdraw the consent can be exercised in any time without prejudice to the lawfulness of the processing performed before the withdrawal and based on the consent already given;

Right to restriction of processing: the data subject shall have the right to obtain from the Data controller restriction of processing where the grounds set out in Article 18 of the GDPR apply;

Right to data portability: the data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to the Data controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another data controller without hindrance from the Data controller to which the personal data have been provided under the conditions set out in Article 20 of the GDPR.

13. Exercise of the rights

The request to exercise the rights outlined in this information to data subject, including particularly the right to erase and the right to withdraw the given consent, must be addressed directly to the Data controller at the email address [email protected]. Alternatively, such rights may be exercised by sending a letter to such effect by registered post with acknowledgement of receipt to Sofiamar S.r.l. at the address Via Paleocapa 6, 20121 Milano (MI);

14. Accessibility to information to data subject

The information to data subject is accessible at the following address ^[completare] as well as at the Data controller’s headquarters. If expressly requested by the data subject, the information may also be orally provided, provided that identity of the data subject is proven, by means of a telephone call to the Data controller’s telephone number.

15. Privacy and newsletter

When the data subject has given his/her consent, through flag, to receiving promotional communications, notices and updates, the relative personal data processing could be performed in order to send communication of commercial information, newsletter, advertising material, to conduct market researches, through traditional contact systems and automated communication systems, including commercial and promotional communications by email or SMS; this is based on the data subject’s consent, given in compliance with this information to data subject. In that case the communication of personal data is not based on a contractual obligation. The data subject shall be allowed to provide his/her personal data; nevertheless, in case of the lack of the communication of the personal data, it will not be possible to carry out marketing activities or send newsletter. The personal data processed in this way will be stored until the data subject will request the relative erasure.