Kama.Sport srl, (CF and VAT number IT04387780168) with registered office in Sarnico (BG), Via Luigi Suardo n.18 / C, which can also be contacted via email at the certified email address kama.sport@legalmail.it, in the person of the pro tempore, in its capacity as Data Controller, with this deed provides the relevant information to the Data Subject. Unless otherwise specified, the regulatory references to articles of law refer to REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 relating to the protection of individuals with regard to the processing of personal data, as well as to free circulation of such data and repealing Directive 95/46 / EC (general regulation on data protection) and subsequent amendments; hereinafter also GDPR.
The interested party has the right to receive specific information regarding the processing of his personal data (art. 13 and 14 EU Reg. 679/2016)
a) The Data Controller of personal data is Kama.Sport srl, (CF and VAT number IT04387780168) with registered office in Sarnico (BG), Via Luigi Suardo n.18 / C PEC kama.sport@legalmail. it, email info@kama.sport.srl, website www.kama.sport.
b) The personal data of the interested party processed, with prior consent, by the Data Controller are the following:
- personal data and information that the interested party provides when using the services provided by the Data Controller, for example during the creation / modification of his account, the creation or publication of content, the sending of messages and the communication with other users (name, surname and email address, which are published through our website or app);
- information on the people and / or groups with whom the interested party interacts and the way in which he interacts with them, as well as the information synchronized by the interested party with the services through their devices (such as, for example, the address book and- mail and contacts of the mobile device);
- information on how the user uses the services, such as the type, frequency, time and duration of execution of various activities;
- information on the devices through which the data subject accesses the services, such as the IP address, the operating system and the browser used;
- preferences, interests and behaviors (profiling) of the interested party relating to the research, consultation and collection of the various series and / or comic books, both for statistical purposes and for profiling purposes.
The data that are a necessary prerequisite to allow the owner to provide the services requested by the interested party are marked with an asterisk or otherwise identified as mandatory. In particular, the provision of personal data is mandatory for the provision of the services requested by the interested party through the website or app, including communication with the interested party regarding the services received and verifying the correspondence of any account created with a real identity. Any refusal to provide the mandatory data makes it impossible for the owner to provide the services to the interested party.
c) Personal data are provided and communicated to the minimum indispensable extent required, in compliance with any contractual commitments provided for in the Terms and Conditions, in order to fulfill the following purposes:
- commercial and advertising contacts, with the consent of the interested party;
- provision of services requested by the interested party through the website or app, including communication with the interested party regarding the services received and verifying the correspondence of any account created with a real identity;
- advertising, promotional and marketing activities, including the sending of newsletters and advertising material on products and services offered by the owner (direct marketing), with the consent of the interested party;
- advertising, promotional and marketing activities, including the sending of newsletters and advertising material on products and services offered by the owner's partner companies or on behalf of third parties (indirect marketing) with the consent of the interested party;
- transfer of user data to third parties for advertising, promotional and marketing activities, including the sending of newsletters and advertising material, with the consent of the interested party;
- profiling of preferences, interests and behaviors of the interested party, in order to provide him with personalized services and advertising more suited to his needs, with the consent of the interested party;
- invoicing and related tax obligations;
d) The lawfulness of the processing is therefore based both on the consent expressed by the interested party and, pursuant to article 6, on the need for processing for legal or contractual purposes.
e) The interested party has the right to ask the data controller for access to personal data and the correction or cancellation of the same or the limitation of the processing of personal data concerning him and to oppose their treatment for legitimate reasons .
f) The interested party also has the right to obtain a copy of personal data in analogue or electronic format that allows portability.
g) The interested party who has given the consent referred to in Article 6, paragraph 1, letter A, has the right to withdraw this consent at any time. However, this does not affect the lawfulness of the processing based on consent before revocation. The interested party is advised that the withdrawal of consent may prevent, in whole or in part, the execution of contracts and relationships.
h) The interested party has the right, in the event of a dispute or difficulty with the data controller, to contact the Italian data processing authority available at the URL http://www.garanteprivacy.it/.
i) Some of the data that are processed by the data controller may have been collected or provided by other sources such as, by way of example, social networks or other databases of third parties.
j) The data controller confirms to the interested party that there is no intention to transfer the personal data of the interested party to third parties outside the European Union. If it is necessary to transfer some or all of the personal data of the data subject outside the borders of the European Union and / or to countries / subjects that have not explicitly adopted the measures required by the GDPR, the data controller will proceed to obtain a new and explicit consent for this purpose by the interested party.
k) The data controller confirms to the interested party, as far as possible, that he will request a similar level of data protection if he has to transfer the personal data of the interested party to third parties for the execution of one of the purposes of above.
Further information for the correctness and transparency of data processing
a) the data of the interested party will be processed and stored for the time necessary in relation to the aforementioned purposes (in particular the provision of the services offered to the interested party) and / or until the prescription or forfeiture of the rights deriving from the relationship. In particular, the data are kept for the entire period during which the interested party has an active account. After 12 (twelve) months from the deactivation of the account, the data is in any case deleted. The data is not deleted immediately after the deactivation of the account by the interested party to allow the latter a right to reconsider without losing the data stored on the account.
b) With regard to sending newsletters, the email address of the person concerned is deleted from the mailing list only at the express request of the latter. If the interested party does not make any request to cancel his email from the newsletter, he will continue to receive the newsletter emails, despite having deleted his account. In each newsletter email that the interested party will receive, there will be a link to unsubscribe the interested party's email from the mailing list.
c) The interested party has the right to ask the data controller for access to personal data and the correction or cancellation of the same or the limitation of the processing of data concerning him or to oppose their treatment for legitimate reasons.
d) The data controller confirms that an automated decision-making process based on profiling or on the use of data of the interested party other than the declared purpose is not used
e) The data of the interested party may be communicated and / or shared with:
- subjects who carry out data processing, measurement and analysis activities on our behalf, with the consent of the interested party;
- subjects who carry out commercial, promotional and advertising activities on our behalf, with the consent of the interested party;
- subjects who perform services for our benefit or collaborate with us, such as technical service providers, postal couriers, hosting providers and IT companies - appointed, if necessary, data processors - for technical or organizational tasks instrumental to the provision of our services;
- online payment processing companies identified in: a) Braintree, internal service of the company PayPal (Europe) S.à.r.l. et Cie, SCA (Luxembourg credit institution with regular license pursuant to Article 2 of the Law of 5 April 1993 on the financial sector as amended, subject to the prudential supervision of the Luxembourg supervisory authority, the Commission de Surveillance du Secteur Financier, whose registered office is located at L-1150 Luxembourg. Since the service is limited to electronic money and is not a deposit or investment service within the meaning of the Law, PayPal customers do not benefit from the guarantee models of the Luxembourg deposits provided by the Association pour la Garantie des Dépôts Luxembourg –AGDL-); b) Apple Pay (https://www.apple.com/it/apple-pay/).
- individuals involved in our data processing organization (for example, administrative, commercial, marketing, customer service and system administrators).
- Accounting firms, law firms, labor consultancy firms, insurance companies, banks, third party suppliers, to the strict extent necessary for the fulfillment of legal or contractual obligations or for the protection of own or third party rights.
f) The personal data entered in the public section of the data subject's account and the content published by the data subject through the account are disseminated through the publication on the app - website www.kama.sport.
g) The data of the interested party may be communicated and / or shared to the extent strictly necessary for the purposes of technical and / or IT maintenance of the service.
The interested party has the right to access the data being processed
The interested party has the right to obtain from the data controller confirmation as to whether or not personal data concerning him is being processed and, in this case, to obtain access to personal data and the following information:
a) the purposes of the processing;
b) the categories of personal data in question;
c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular if they are recipients of third countries or international organizations;
d) when possible, the retention period of the personal data envisaged or, if not possible, the criteria used to determine this period;
e) the existence of the data subject's right to ask the data controller to rectify or delete personal data or limit the processing of personal data concerning him or to oppose their processing;
f) the right to lodge a complaint with a supervisory authority;
g) if the data is not collected from the data subject, all available information
h) their origin;
i) the existence of an automated decision-making process, including profiling and, at least in such cases, significant information on the logic used, as well as the importance and expected consequences of such processing for the data subject.
j) If personal data are transferred to a third country or to an international organization, the interested party has the right to be informed of the existence of adequate guarantees relating to the transfer.
The data subject has a right to rectify the data processed under certain conditions
The interested party has the right to obtain from the data controller the correction of inaccurate personal data concerning him without undue delay. Taking into account the purposes of the processing, the interested party has the right to obtain the integration of incomplete personal data, also by providing an additional declaration.
The data subject has a right to cancel the data, the so-called "right to be forgotten", under certain conditions
The data subject has the right to obtain from the data controller the deletion of personal data concerning him without undue delay and the data controller is obliged to cancel the personal data without undue delay, if one of the following reasons exists :
- personal data are no longer necessary with respect to the purposes for which they were collected or otherwise processed;
- the interested party revokes the consent on which the processing is based in accordance with article 6, paragraph 1, letter a), or article 9, paragraph 2, letter a), and if there is no other legal basis for the treatment;
- the interested party opposes the processing pursuant to Article 21, paragraph 1, and there is no legitimate overriding reason to proceed with the processing, or opposes the processing pursuant to Article 21, paragraph 2;
- the personal data have been unlawfully processed;
- personal data must be deleted to fulfill a legal obligation under the law of the Union or of the Member State to which the data controller is subject;
- personal data was collected in relation to the information society service offer referred to in Article 8, paragraph 1.
The data controller, if he has made personal data public and is obliged to delete them, taking into account the available technology and implementation costs, adopts reasonable measures, including technical ones, to inform the data controllers that they are processing the data personal data of the interested party's request to delete any link, copy or reproduction of his personal data.
This right to cancellation is not applicable to treatments carried out for the assessment, exercise or defense of a right in court, pursuant to art. 17, paragraph 2, letter E.
The interested party has the right to limit the processing of his data in certain cases
The interested party has the right to obtain from the data controller the limitation of processing when one of the following hypotheses occurs:
a) the data subject disputes the accuracy of personal data, for the period necessary for the data controller to verify the accuracy of such personal data;
b) the processing is unlawful and the interested party opposes the deletion of personal data and instead requests that its use be limited;
c) although the data controller no longer needs it for the purposes of processing, the personal data are necessary for the data subject to ascertain, exercise or defend a right in court;
d) the interested party opposed the processing pursuant to Article 21, paragraph 1, pending verification of the possible prevalence of the legitimate reasons of the data controller with respect to those of the interested party.
If the processing is limited, such personal data are processed, except for conservation, only with the consent of the interested party or for the assessment, exercise or defense of a right in court or to protect rights of another natural or legal person or for reasons of significant public interest of the Union or of a Member State.
The interested party who has obtained the processing limitation is informed by the data controller before this limitation is revoked.
In case of rectification or cancellation of personal data or limitation of processing, the owner must notify such facts to the third party recipients of the data
The interested party must know that the data controller will communicate to each of the recipients to whom the personal data have been transmitted any corrections or cancellations or limitations of the processing unless this proves impossible or involves a disproportionate effort. The data controller will notify the data subject of these recipients if the data subject requests it.
The data subject has the right to the portability of his data
The interested party has the right to receive in a structured format, commonly used and readable by an automatic device, the personal data concerning him provided to a data controller and has the right to transmit such data to another data controller without impediments on the part of the data controller to whom he provided them if:
a) the processing is based on consent pursuant to article 6, paragraph 1, letter a), or article 9, paragraph 2, letter a), or on a contract pursuant to article 6, paragraph 1, letter b); is
b) the processing is carried out by automated means.
In exercising their rights relating to data portability, the interested party has the right to obtain the direct transmission of personal data from one data controller to the other, if technically feasible.
The exercise of the right does not apply to the processing necessary for the execution of a task in the public interest or connected to the exercise of public authority vested in the data controller and must not affect the rights and freedoms of others .
The interested party has the right to object to the processing of his data
The interested party has the right to object at any time, for reasons connected to his particular situation, to the processing of personal data concerning him pursuant to article 6, paragraph 1, letters e) or f), including profiling on the basis of these provisions. The data controller refrains from further processing personal data unless he demonstrates the existence of compelling legitimate reasons to proceed with the processing that prevail over the interests, rights and freedoms of the data subject or for the assessment, exercise or the defense of a right in court.
If personal data are processed for direct marketing purposes, the interested party has the right to object at any time to the processing of personal data concerning him for these purposes, including profiling to the extent that it is connected to this direct marketing.
If the interested party objects to the processing for direct marketing purposes, the personal data are no longer processed for these purposes.
The interested party has the right to object to automated decision-making
The interested party has the right not to be subjected to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or which significantly affects his person, subject to the exceptions referred to in 'art. 22, paragraph 2.
Personal data are protected and the types of treatment are recorded
The Data Controller informs the interested party that the data are processed both analogically (on paper) and electronically.
The persons in charge of processing have received specific training and specific authorizations for data processing and are bound by obligations of secrecy.
The data stored in electronic form are protected by:
a) use of updated computers, operating systems and programs;
b) security software;
c) backup and disaster recovery strategies;
In certain cases the data controller will have to communicate any data breaches to the supervisory authority and to the interested party
In the event of a personal data breach, the data controller notifies the competent supervisory authority pursuant to Article 55 without undue delay and, where possible, within 72 hours from the moment in which it became known , unless a breach of personal data is unlikely to present a risk to the rights and freedoms of individuals. If the notification to the supervisory authority is not made within 72 hours, it is accompanied by the reasons for the delay.
The data controller documents any breach of personal data, including the circumstances relating to it, its consequences and the measures taken to remedy it.
When the violation of personal data is likely to present a high risk for the rights and freedoms of individuals, the data controller communicates the violation to the interested party without undue delay.
The interested party will receive any future changes relating to this information
The company will inform the interested party via e-mail when changes are made to this information, requesting the same to accept the changes to continue using the services we provide.
The uninterrupted use of our services following the communication of the changes made to this Notice constitutes implicit acceptance of the changes
The Owner has adopted the Register of Processing Activities pursuant to art. 30 GDPR
This register contains at least all of the following information:
a) the name and contact details of the data controller and, where applicable, the joint data controller, the data controller's representative and the data protection officer;
b) the purposes of the processing;
c) a description of the categories of data subjects and of the categories of personal data;
d) the categories of recipients to whom the personal data have been or will be disclosed, including recipients in third countries or international organizations;
e) where applicable, transfers of personal data to a third country or an international organization, including the identification of the third country or international organization and, for the transfers referred to in the second paragraph of Article 49, documentation of adequate guarantees;
f) where possible, the deadlines set for the cancellation of the various categories of data;
g) where possible, a general description of the technical and organizational security measures referred to in Article 32 (1).
It was not necessary to appoint a Data Protection Officer (DPO)
Pursuant to art. 37 of the EU Reg. No. 679/2016 (GDPR), it should be noted that the Company is not a public authority or a public body and also that it is not considered reasonable to consider the Company's business as "on a large scale" for the following considerations:
- the number of interested parties involved in data processing is very small in absolute terms, representing a small percentage with reference to the population of the geographical area in which the Company mainly provides its services;
- the amount of data processed appears to be in the standard, usually requiring the Company only data for the identification of the interested parties and the data processed are of a normal type, since particular categories of personal data are not processed (only: name , surname and email address);
- the processing lasts for the time necessary to provide the services to the interested party and, in any case, until the interested party withdraws his consent;
- the size of the company is extremely small, as is its turnover, as it is fully part of the SME category;
For these reasons, it was not considered mandatory for the Company to appoint a data protection officer pursuant to art. 37, EU Reg. No. 679/2016 (GDPR).
COOKIES INFORMATION
In order to make your visit to our website as convenient and efficient as possible, we use cookies and similar technologies, such as scripts.
Cookies are small text files sent from our website and recorded locally in the temporary memory of your browser (and therefore on your computer) - for variable periods of time depending on the need and generally between a few hours and a few years - to be retransmitted by your browser to our website on your next visit. Using cookies, it is possible to semi-permanently record information relating to your preferences and other technical data that allow easier navigation and greater ease of use and effectiveness of our website. For example, cookies can be used to determine if a connection has already been made between your computer and our websites, to highlight news or keep login information.
Scripts are tools for analyzing the usability of our web pages and consist of small software programs temporarily activated in some of the pages of our websites, which intercept in a completely anonymous way a set of interaction events with the contents of the website itself (for example, the click, the path of the mouse and the time spent by the mouse in a certain position). At the end of the collection activities, this information is aggregated and analyzed to understand how to improve the structure of the web page or service.
The activation of cookies, scripts and all technologies similar to cookies is subject to acceptance of the Cookies Policy. By continuing to browse this website, closing the information strip or clicking on any part of the page or scrolling it to view further content, you put in place a manifest and explicit act of acceptance of the Cookies Information and the cookies of which the refusal was not declared.
In the event that you have concerns about the use of cookies or similar technologies, you can always intervene to prevent their storage and reading by changing the privacy settings in your browser. You can also exercise your right to object to the full use of cookies by leaving this website and thus also refusing the use of essential technical cookies necessary for its operation.
Any request for clarification or exercise of your rights can be addressed to KAMA.SPORT s.r.l., Via Luigi Suardo n.18 / C, Sarnico (BG), PEC: kama.sport@legalmail.it. Furthermore, you always have the right to lodge a complaint with the Privacy Guarantor through the website www.garanteprivacy.it.
Cookies in more detail
This website can use four different types of cookies:
(A) Essential technical cookies
These cookies are necessary for the website to function properly. They allow you to browse pages, share content, store your login credentials to speed up access to the site and to keep your preferences and credentials active while browsing. Without these cookies we could not provide the services for which users access our website.
(B) Essential technical cookies for statistics and performance analysis
These cookies allow us to know how visitors use the website, in order to be able to evaluate and improve its functioning and to favor the production of contents that best meet the information needs of our users. For example, they let you know which pages are the most and least visited. They take into account, among other things, the number of visitors, the time spent on the site by the average number of users and how they arrive. In this way, we can know what works well and what to improve, as well as make sure that the pages load quickly and are displayed correctly.
(C) Cookies for user profiling aimed at advertising targeting, for the provision of external features integrated into the website
These cookies allow you to offer the user advertisements relating to his interests. They are also used to limit the number of views of the same advertisement and to evaluate the effectiveness of advertising campaigns.
(D) Third party functional and profiling cookies
This category includes both cookies provided by our partners and cookies provided by third parties not directly controlled or controllable by us. The cookies from our partners allow us to offer advanced features, as well as more information and personal functions, such as the ability to share content through social networks. These services are mainly provided by external operators hired by us or knowingly integrated. If you have an account or if you use the services of these parties on other websites, they may be able to know that you have visited our site. The use of the data collected by these external operators through cookies is subject to the respective privacy policies. These include cookies registered by the main social networks that allow you to share the contents of our websites and to publicly express your appreciation for our work. Cookies not originating from our partners are conveyed, without our control, by third parties who are able to intercept the user while browsing even outside our websites. These cookies, typically profiling cookies, are not directly controllable by us and we cannot therefore guarantee the use that third parties make of the information collected. The opposition to the use of these cookies is therefore delegated to external tools or to direct action on your part on the preferences of your browser.