Privacy

INFORMATION ON THE PROCESSING OF PERSONAL DATA PURSUANT TO ART. 13 EU REG. NO. 2016/679 (GDPR)

1. PURPOSE OF PROCESSING

Edoardo Scellato, owner of the brand Guardaroba Revolution (hereinafter also "the Controller"), processes your personal data for the following purposes:

  • a) to appraise and inspect clothing and accessories in order to assess their authenticity and conformity status in fulfillment of the contractual obligation assumed by the Controller;

  • b) management of pre-contractual negotiations and stipulation of sales or consignment contracts, as well as fulfillment of the related contractual obligations assumed by the Controller;

  • c) correct administrative, fiscal and accounting management of sellers/customers, including the fulfillment of all obligations provided for by law and regulations, including anti-money laundering legislation where applicable;

  • d) defense in court of its rights and interests, for example in case of litigation or default;

  • e) video surveillance inside the showroom/shop premises for security purposes and protection of company assets;

  • f) direct marketing activities by sending promotional, commercial and informative communications (including newsletters) via email;

  • g) promotion of the Controller's activity through the reproduction on digital channels and social networks (e.g. Instagram, TikTok, etc.), by any technical means, of photos and videos portraying the person or reproducing the voice of the data subject, made during the activities functional to the selection and preparation of the appraisal at the premises available to Guardaroba Revolution.

2. LEGAL BASIS

The legal bases for the processing indicated in paragraph 1 are as follows:

  • For purposes (a) and (b): performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

  • For purpose (c): compliance with a legal obligation to which the Controller is subject;

  • For purposes (d) and (e): pursuit of the legitimate interest of the Controller (protection of its rights and protection of company assets);

  • For purposes (f) and (g): the consent given by the data subject.

3. METHODS OF PROCESSING

The data processing will be carried out lawfully, fairly and transparently and, in any case, in compliance with the provisions of Articles 5 and 6 of the GDPR. The processing will be carried out by means of the operations or set of operations indicated in Article 4, point 2 of the GDPR, including: collection (data acquisition), recording (storage), organization, retention, consultation (reading), communication to specific subjects and use of personal data.

Operations may be carried out with or without the aid of electronic and IT tools, in compliance with the confidentiality and security rules provided by law, regulations or specific internal provisions. Your personal data will be entered into a specific archive kept under constant control through an internal operating procedure, in accordance with the provisions of the GDPR. Data is processed and stored at the Controller's operating office.

The video surveillance system in the showroom is equipped with cameras. The filmed images can be viewed live on dedicated monitors and are active 24 hours a day, 7 days a week. Access to the data and images of the recording device is possible remotely, via specific protected software, exclusively by authorized personnel with access credentials. The video-monitored areas are duly indicated with specific signs before the cameras' range of action.

4. NATURE OF THE PROVISION OF DATA

Your data is collected directly from the data subject. The provision of the following data is to be considered indispensable for the conclusion of the contract: name, surname and identity document details/references. Consequently, failure to provide such data will make it impossible to establish and/or continue the contractual relationship between the parties.

The provision of all other data, however, is to be considered accessory and optional. Failure to provide the latter does not prejudice the establishment of the relationship, but may make it difficult to correctly manage related activities or provide personalized services.

5. COMMUNICATION AND/OR DISSEMINATION

Your data may be communicated to subjects expressly authorized/appointed for processing, as well as to all third parties to whom communication is strictly necessary for the correct fulfillment of the purposes indicated in paragraph 1. These third parties may include, by way of example and not limitation:

  • external professionals and consultants (such as accountants, labor consultants, lawyers and tax experts) whose intervention is deemed necessary;

  • public bodies delegated to tax, civil and criminal control and other competent Public Authorities or Institutions;

  • credit institutions and digital payment platforms used for transactions.

Personal data will not be sold, rented or transferred to unspecified third parties for their own commercial purposes. The processing indicated in paragraph 1, letter g) involves the dissemination of personal data (images/videos), through the publication and sharing of multimedia content on the official social network channels of the brand.

6. TRANSFER ABROAD AND TO INTERNATIONAL ORGANIZATIONS

The management and storage of personal data takes place on servers located within the European Union. Generally, your personal data is not transferred outside the European Economic Area (non-EU Countries) by the Controller.

However, it should be noted that, through the marketing and promotion processing on social media indicated in paragraph 1, letter g), the published multimedia data (photos/videos) may be stored on the servers of the Social Network platforms used (e.g. Meta, TikTok), which may be located in non-EU countries, in compliance with their respective privacy policies and the international transfer mechanisms provided by their respective operators in accordance with the GDPR.

7. PERIOD OF RETENTION

The data will be retained for the time strictly necessary to fulfill the purposes indicated in this policy, as well as to comply with legal obligations (e.g., 10 years for accounting and tax data), and in any case within the prescriptive terms set for the rights and obligations underlying the processing.

Regarding direct marketing activities and newsletters (paragraph 1, letter f), data will not be retained for a period longer than 24 months from the time of collection or from the last formal contact, unless consent is revoked earlier. A periodic annual review is carried out on the processed data and on the possibility of deleting them if they are no longer necessary for the intended purposes.

Images from the video surveillance system are kept for a maximum of 24 hours, except for special needs of further retention in relation to holidays, showroom closures, or if a specific investigative request from the Judicial Authority or the Police Forces must be adhered to. At the end of the retention period, the images are automatically deleted by overwriting.

8. AUTOMATED DECISION-MAKING PROCESSES

It is specified that the Controller does not carry out processing consisting of automated decision-making processes on your personal data, nor does it carry out automated profiling activities aimed at profiling individual behaviors for discriminatory or invasive purposes.

9. RIGHTS OF THE DATA SUBJECT

As a data subject, you may at any time exercise your rights towards the Controller by contacting them using the following official contact details of Guardaroba Revolution:

  • E-mail: [Insert correct email address, e.g. info@guardarobarevolution.it]

To ensure the correct exercise of rights, the applicant must identify themselves unequivocally. The Controller undertakes to provide a response within 30 days of the request and, in case of a justified inability to meet these deadlines, to communicate any extension of the foreseen terms. The response will be provided free of charge, except in cases of manifest unfoundedness or manifestly excessive or repetitive requests, for which a contribution to expenses not exceeding the costs actually incurred for the research carried out may be charged.

Pursuant to articles 15 to 22 of the GDPR, you have the right to:

  • Ask for confirmation of the existence or not of your personal data and obtain access to it;

  • Obtain information about the purposes of the processing, the categories of data, the recipients and the foreseen retention period;

  • Obtain the rectification of inaccurate data or the integration of incomplete data;

  • Obtain the erasure of data (right to be forgotten) where the legal conditions apply;

  • Obtain the restriction of processing;

  • Obtain data portability in a structured, commonly used and machine-readable format;

  • Object to the processing at any time, in whole or in part, in particular for direct marketing purposes;

  • Withdraw consent at any time (for processing based on it) without affecting the lawfulness of processing carried out before the withdrawal.

Furthermore, if you believe that the processing of your data violates the GDPR, you have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or to appeal to the competent judicial authorities.

10. DATA CONTROLLER

The Data Controller of personal data is Edoardo Scellato, for activities related to the brand Guardaroba Revolution, with operational/legal headquarters in Tuscany (Italy) - Email: [Insert contact email]. A Data Protection Officer (DPO) has not been appointed, as none of the mandatory cases provided for by Art. 37 of the GDPR apply.

11. AUTHORIZED/APPOINTED PERSONS FOR PROCESSING

Authorized and appointed persons for the processing of personal data, in accordance with the provisions of European Regulation 2016/679 (GDPR) and the instructions given by the Controller, are the collaborators and employees of Guardaroba Revolution within the scope of their respective duties.