The methods for processing personal data collected automatically or provided through the navigation or use of the website https://www.braking.com/it/ (the “Website”) by users of the same (the “Users”) are set out below.

1. DATA CONTROLLER

The Data Controller is the company Braking S.r.l., with registered office in Giussano, Via Virgilio n. 6 20833, C.F. and VAT no. no. 02487330512, registered at the Register of Companies of Milano Monza Brianza Lodi REA MB-2742175 (hereinafter referred to as "Company", "Braking" or "Data Controller").

2. TYPE OF DATA PROCESSED

In order to enable the use of the Website and to allow the purchase of products therein, the Data Controller needs to know and process the following personal data relating to Users:

• Navigation data

Whenever Users access the Website, the computer systems and procedures used software to operate the Website acquire, in the course of their normal operation, access and navigation data, such as: information on the browser used by the User, the operating system of the device used to use the services, website, date, time and duration of each visit, as well as other parameters relating to the User's computer environment.

• Data communicated voluntarily by the User for the purpose of creating an account and in order to use the services.

The Website also collects the personal data necessary to allow the User to register - via the registration form - create an account and use the services.

In particular,

1. a) Identification data, such as first name, last name, nationality, address, billing address residential of the User.
2. b) Contact data, such as e-mail address, telephone of the User.
3. c) Payment data, such as purchase data, date, time, purchase history, payment methods (including credit card credit card holder and data), as well as any personal data contained in communications between the data subject and the Data Controller, and relating to products purchased by the User.

The data relating to transactions carried out as part of the use of the services and the data relating to the payment methods chosen by the User will be processed - as an autonomous owner - by Shopify Payments (Shopify International Limited 2nd Floor, 1-2 Victoria Buildings Haddington Road Dublin 4, D04 XN32, Ireland IVA IE3347697KH), the institute with which Braking has defined the agreements for the provision of payment services through the Website.

Braking shall not have any access to such data (in particular, it shall not have access to and/or visibility of such data) and shall not determine in any way the purposes and methods of processing by the payment institution.

• Data acquired through Cookies

Cookies are used on the Website to enable the processing of additional personal data of the User acquired during the User's navigation on the Website. The information concerning the processing of data personal acquired through cookies can be found in the relevant Cookie Policy: https://braking-srl.myshopify.com/pages/cookie-policy. 

Browsing data, data communicated voluntarily by the User for the purpose of creating an account and in order to use the services, and data acquired via cookies, hereinafter jointly referred to as “Personal Data”.

3. PURPOSE, LEGAL BASIS OF PROCESSING AND NATURE OF CONFERMENT

The Personal Data provided by the User will be used exclusively for the following purposes:

1. Braking will process Personal Data to allow the User to create an account and use the services and to perform related activities. The legal basis for the processing of Personal Data for these purposes is the performance of the contract to which the User is a party. The provision of Personal Data is mandatory. Failure to provide it will make it impossible to use the services;
2. Personal Data are processed in order to allow Braking to contact Users in order to send them individual communications related to the contractual relationship already established with them and/or related to possible satisfaction surveys. The legal basis for such processing lies in the legitimate interest of the Company in maintaining and strengthening the human and professional relations established with Users, also through constant assistance and support in the use and enjoyment of the services provided. This legitimate interest finds its respective balance in the Users' interest to have constant support and assistance as well as in the prospect of functional solutions to every need, and with a view to improving the services offered. The Data Controller also believes that sending such communications does not violate the rights of the data subjects.
3. Personal Data will be processed in order to answer and follow up on the requests that Users send to Braking through the e-mail address and the contact details present in the various sections of the Website. The legal basis for this processing is the legitimate interest of the Data Controller in pursuing its business activities to follow up on Users' requests. This legitimate interest has been duly balanced against the reasonable expectations of the data subjects and, since it does not prejudice the rights of the data subjects involved and the processing of Data Personal is carried out at the request of the User, it has been deemed to prevail. The provision of Personal Data for the above-mentioned purposes is necessary for the proper handling and execution of the requests. Any partial or total refusal to provide Personal Data for such purposes will make it impossible for the Data Controller to fulfil such requests;
4. Braking collects and processes Personal Data provided by the Users in order to send the newsletter and to allow the Users to benefit from this service and to receive commercial offers, promotions and communications on Braking products. This processing has its legal basis in the consent of the data subject. Users may revoke the consent given and cancel their subscription to the newsletter service at any time by clicking on the “unsubscribe/unsubscribe” link, entering their email address in the form on the page and clicking on the “unsubscribe/unsubscribe” button. Alternatively, Users may send a specific communication to the Data Controller, at the addresses indicated in the “Data Subjects’ Rights” section, expressing their wish to unsubscribe from the newsletter service and to cancel the data held by the Data Controller. Withdrawal of consent does not affect the processing already carried out. The provision of Personal Data is optional. Refusal to provide Personal Data will result in the impossibility of using the newsletter service;
5. the Company will process Personal Data in order to fulfil Braking's legal obligations or the performance of specific tasks arising from the law, from a regulation or from national and European The legal basis for the processing of Personal Data is the fulfilment of a legal obligation;
6. the Company shall process Personal Data for the needs of judicial defence in connection with possible disputes that may arise with the User following the creation of an account and the contextual use of services. The legal basis for the processing of Personal Data is the legitimate interest in judicial defence, which does not prejudice the rights and freedoms of the data subjects, since the processing of data for the purpose in question is limited to data not belonging to the special categories of personal data referred to in Article 9 of the GDPR and is necessary for the exercise of a right constitutionally guaranteed to the Data Controller;
7. Personal Data shall also be processed in order to monitor the proper functioning of the Website and allow the Data Controller to make changes and improvements to it, as well as to solve any operating problems. The provision of Personal Data takes place automatically by connecting to the Website and any partial or total refusal to provide Data Personal for such purposes will make it impossible for the Data Controller to properly manage the operation and maintenance of the Website.
8. PERSONAL DATA RETENTION PERIOD

The Data Controller intends to keep Personal Data for no longer than is necessary to fulfil the purposes for which it was collected and processed.

For the purposes referred to in points a) and b) of paragraph 3, Personal Data shall be retained for a maximum period of 10 years from the deletion of the account or from the termination of the contractual relationship between the User and the Company, within which the aforementioned processing operations are carried out, in accordance with the provisions of the statute of limitations.

For the purpose referred to in letter c) of paragraph 3, the Company will retain Personal Data for the time necessary to process the User's request and, in any case, no longer than the terms provided for by the statute of limitations with reference to contractual/extracontractual torts, if the communications between the User and Braking are necessary for the latter for the purposes of judicial protection.

For the purpose referred to in point d) of paragraph 3, the Company will keep the Personal Data for a maximum period of 24 months from the granting of consent to subscribe to the newsletter service. With one month notice, Braking will ask the User if User wishes to continue receiving such communications: in case of refusal, the Personal Data provided will be deleted; in case of consent, it will be stored and processed for the further period of 24 months.

For the purpose referred to in point e) of paragraph 3, Personal Data will be processed for as long as required by the legal regulations with which Braking must comply.

For the purpose referred to in point (f) of paragraph 3, Personal Data will be retained in accordance with the provisions of the statute of limitations with regard to torts of a contractual/extracontractual nature.

For the purposes referred to in point g) of paragraph 3, Personal Data will be retained for as long as it is necessary to resolve any bugs and malfunctions of the Website, as well as for as long as required by the legal regulations with which Braking must comply.

With regard to Data Personal acquired through cookies, the retention periods are indicated in the Cookie Policy: https://braking-srl.myshopify.com/pages/cookie-policy.

5. CATEGORIES OF DATA RECIPIENTS

The Personal Data subject to processing shall not be disclosed to third parties. Personal Data may be known by employees, partners and/or collaborators in any capacity of the Data Controller, specifically instructed and authorised to process them (such as, by way of example, employees belonging to the IT function).

In addition, Personal Data may be accessed by third parties who provide services to the Company (for example, suppliers of IT services for database management, providers of cloud storage and/or file-transfer services, IT consultants, subjects who provide services for the management of payments, such as Shopify Payments, for example, to allow the payment of purchases through the Site).

Where they do not act as independent data controllers, these subjects have been specifically appointed as Personal Data processors, and their names are available upon request to the Data Controller.

Any further communication or dissemination will take place only with the explicit consent of the User.

6. TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES

The Data Controller does not transfer Personal Data outside the European Union.

Where this is necessary to achieve the purposes set out in paragraph 3 of this privacy policy, the Data Controller shall only make such transfer to entities located in States in respect of which there is an adequacy decision of the European Commission or by adopting the appropriate measures referred in Article 46 of the GDPR.

7. RIGHTS OF THE DATA SUBJECT

As a data subject, the User is the holder of the rights conferred by the GDPR pursuant to Articles 12-23 of the GDPR. In particular, data subjects have the right to request and obtain, at any time: (i) access to their Personal Data; (ii) information about the processing carried out; (iii) rectification and/or updating of Personal Data; (iv) erasure of Personal Data; (v) restriction of processing; (vi) to exercise the right to object to processing; (vii) portability of Personal Data (i.e. receiving Personal Data in a structured, machine-readable, commonly used format), (viii) to exercise the right to withdraw one's consent to the processing of Personal Data, where such consent is the legal basis for the specific purpose for which the processing is carried out (this, in any case, will not affect the lawfulness of the processing carried out on the basis of the consent given before the revocation), and, finally, (ix) to lodge a complaint with a data protection authority (in Italy: the “Garante per la Protezione dei Dati Personali”).

The aforementioned rights may be exercised at any time, by simple request to the Data Controller, to be transmitted:

• To the e-mail address: contacts@braking.com
• At the address: Via M.P. Virgilio, 6 - 20833 Giussano (MB) - Italy.

For further information or clarifications on the aforementioned rights, please contact the Company at the same contacts.

This privacy police may be subject to change over time - also in connection with the possible entry into force of new sector regulations, the updating and/or provision of new services or technological innovations - so we invite the User to periodically consult this page.

Privacy Policy updated on [-].

• I declare that I have read the privacy policy on the processing of personal data, pursuant to Article 13 of the GDPR.
• I declare that I wish to receive the Braking newsletter.