PRIVACY NOTICE

Notice pursuant to Articles 13 and 14 of EU Regulation No. 2016/679

Pursuant to Articles 13 and 14 of EU Regulation No. 2016/679 (hereinafter “GDPR 2016/679”), containing provisions for the protection of persons and other subjects with respect to the processing of personal data, we inform you that the personal data you provide to ART FROM ITALY DESIGN DI MONTICONE DARIO & C. S.A.S., VAT number 02721590020, with registered office in Via delle Industrie, 40 - 13856 Vigliano Biellese (BI), will be processed in compliance with the aforementioned legislation and the confidentiality obligations to which ART FROM ITALY DESIGN DI MONTICONE DARIO & C. S.A.S. is bound. which will take possession of it.

We hereby inform you of the following:

1) Data Controller

The data controller is ART FROM ITALY DESIGN DI MONTICONE DARIO & C. S.A.S., VAT No. 02721590020, with registered office at Via delle Industrie, 40 - 13856 Vigliano Biellese (BI).

2) Purpose of processing and source of personal data

The processing of the data subject's personal data has one or more of the following purposes:

• Sending informational and/or promotional material by post; managing mailing lists; Management of any objections to processing;
• Maintenance of documentary evidence (accountability), possible legal protection;
• Comply with legal obligations or orders from authorities.

The data subject's personal data is provided to the Data Controller by qualified database providers who operate as data providers and collect data from public registers, lists, and official public sources. This information is available upon request.

3) Data Subjects and Type of Data Processed

Data subjects are potential customers of the Data Controller.
The personal data processed are: identification and contact details (e.g., first name, last name, company name if attributable to a natural person, postal address, postal code, city).

4) Provision of Data and Refusal to Provide Data

Provision of personal data is not mandatory; personal data may come from sources other than the data subject. The data subject may object to processing for direct marketing purposes at any time.

5) Legal bases for processing

The legal basis – the condition for which we may process the data subject's ordinary personal data – is the legitimate interest of the Data Controller in carrying out direct marketing activities (Article 6, paragraph 1, letter f) of the GDPR 2016/679, Recital 47).

The legal basis – the condition for which we may process the data subject's ordinary personal data – is the legitimate interest of the Data Controller in exercising his or her rights, such as the right to defense in court (Article 6, paragraph 1, letter f) of the GDPR 2016/679).

The legal basis – the condition for which we may process the data subject's ordinary personal data – is the necessity to fulfill obligations established by law, by a regulation, by EU legislation, or by an order of the Authority to which the Data Controller is subject (Article 6, paragraph 1, letter c) GDPR 2016/679).

6) Processing methods, location, and data storage

The data subject's personal data is processed using paper and electronic means in accordance with the principles of lawfulness, fairness, transparency, data minimization, and storage limitation.

The processing is carried out by specifically appointed persons and in compliance with the provisions of Article 29 of the GDPR 2016/679.

The Data Controller has adopted and documented specific and adequate technical and organizational security measures in accordance with Article 32 of EU Regulation no. 2016/679 aimed at minimizing the risk of destruction or loss of data, illicit or incorrect use, unauthorized access, or processing that is unauthorized or inconsistent with the purposes for which it was collected (access controls, transaction tracking, instructions to authorized parties, segregation of opt-out lists).

The retention period is a maximum of 24 months from the date of acquisition of the personal data. After the retention period has expired, or if the data subject objects to the processing, the Data Controller will delete the processed data. The data essential for managing the Opt-out List will be retained to prevent future unwanted communications.The data subject's personal data will be processed at the Data Controller's registered office.

7) Data Disclosure

The data subject's personal data will be disclosed exclusively to qualified third parties and only where required by law or necessary to provide the requested services, ensuring the protection of the data subject's rights and in compliance with EU Regulation no. 2016/679 and the Privacy Code, duly appointed as data processors or persons authorized to process data.

The data subject's personal data may be disclosed to:

• postal, printing, packaging, and shipping logistics providers, who act as data processors;
• documentary record keeping (accountability), possible legal protection;
• persons appointed and/or authorized by the Data Controller;

The complete list of data processors can be provided by the Data Controller by sending a written request to the email address info@artfromitaly.it

8) Disclosure of data

Personal data of the interested party are not disclosed.

9) Transfer of data abroad

The personal data processed by the Data Controller are recorded and stored on electronic databases located in countries belonging to the European Economic Area (EEA) and are not transferred to countries outside the European Union or the European Economic Area (so-called Third Countries).

If, for technical reasons, transfers outside the EEA are necessary, they will be carried out in compliance with Chapter V of the GDPR (adequacy decisions, standard contractual clauses, supplementary measures). Specific information is available upon request.

10) Rights of the interested party

At any time, the interested party may exercise, pursuant to Articles 15 to 22 of EU Regulation no. 2016/679, the right to:

• request confirmation of whether or not personal data concerning you exists;
• obtain information regarding the purposes of the processing, the categories of personal data, the recipients or categories of recipients to whom the personal data have been or will be disclosed and, where possible, the retention period;
• obtain rectification and erasure of data;
• obtain restriction of processing;
• obtain data portability, i.e., receive data from a data controller in a structured, commonly used, and machine-readable format and transmit it to another data controller without hindrance;
• object to processing at any time, including for direct marketing purposes;
• object to automated individual decision-making, including profiling;
• ask the data controller Access to and rectification or erasure of personal data, restriction of processing concerning you, or the right to object to such processing, as well as the right to data portability;
• Withdraw your consent at any time, without prejudice to the lawfulness of processing based on consent before its withdrawal;
• Lodge a complaint with the Italian Data Protection Authority (contact details at www.garanteprivacy.it) or another supervisory authority.

These rights may be exercised by simply sending a communication, including via email, to the following email address info@artfromitaly.it or by sending a written request to ART FROM ITALY DESIGN DI MONTICONE DARIO & C. S.A.S., Via delle Industrie, 40 - 13856 Vigliano Biellese (BI).

You will receive a response in an intelligible form, preferably by email, no later than one month after your request. If you believe your rights or the procedure have not been respected, you may lodge a complaint with the Italian Data Protection Authority (contact details at www.garanteprivacy.it).

You will, however, have the right to obtain, with a reasoned and documented request, the rectification or integration of your data if it is inaccurate or incomplete. This request will be carried out without delay, after verification of your request. In some cases, you may also request that processing be limited if the conditions set forth by law are met (procedure to verify the accuracy of the data, unlawful processing, need to use the data to assert a right, verification of the existence of a legitimate interest).

For data processed by automated systems, you will also have the right to receive, upon request at the addresses indicated above, the personal data concerning you that you have provided in a structured, commonly used, and machine-readable format for the purpose of communicating it to another data controller (right of portability).

11) Special categories of personal data and personal data relating to criminal convictions and offenses

The Data Controller & C. S.A.S. does not process, on behalf of the data subject, data that can be classified as "special categories of personal data," i.e., data revealing "racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as data concerning health, genetic data, biometric data intended to uniquely identify a natural person, data concerning a natural person's sex life or sexual orientation" as per Article 9 of EU Regulation No. 2016/679, and does not process personal data relating to criminal convictions and offenses as per Article 10 of EU Regulation No. 2016/679.

12) No Profiling

No fully automated decision-making processes or profiling that produce legal effects or significantly affect the data subject are used; minimal segmentation (e.g., product category/territory) may be used, strictly necessary for selecting postal items.

Data Controller: ART FROM ITALY DESIGN DI MONTICONE DARIO & C. S.A.S.
Information updated on October 3, 2025