E-commerce website www.servettocose.com (pursuant to articles 13 and 14 of EU Regulation 2016/679 – "GDPR")
The Data Controller is Servetto S.r.l. - with registered office at Via Brughetti 32 - 20813 Bovisio Masciago (MB), Italy. Tel No. +39 0362 55.88.99 Email: info@servetto.it, Certified email: servetto@pec.it.
Pursuant to Article 28 of the GDPR, Servetto S.r.l. engages third parties as Data Processors to carry out specific activities, such as the provider of hosting and technical website management services and persons responsible for shipping and accounting management. The updated list of Data Processors is available at the Data Controller’s offices and may be requested by writing to the addresses listed in Section 10.
This privacy policy is provided pursuant to Article 13 GDPR and applies to personal data collected directly from the data subject (browsing data, data provided through contact forms, registration and purchase data, and identification data for collection). Where, in exceptional cases, the Data Controller processes personal data that has not been collected directly from the data subject but from third parties (for example, from couriers or individuals collecting goods on behalf of the data subject), the provisions of Article 14 GDPR shall apply, and the relevant information shall be provided within the timeframes under Article 14, para. 3, GDPR.
4. Principles relating to processing (Article 5 GDPR)
Personal data shall be processed in compliance with the principles of lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality set out in Article 5, para. 1 of the GDPR, as well as the principle of accountability pursuant to Article 5, para. 2, and Article 24 GDPR, whereby the Data Controller is able to demonstrate that processing is performed in compliance with the GDPR.
5. Categories of data, purposes and legal basis (Articles 6, 13 para. 1 letter c) GDPR)
With regard to the purposes under letter f), it is specified that the exemption from consent referred to in Article 130, para. 4 of the Italian Privacy Code applies exclusively to customers who have concluded a sales contract for consideration, and does not apply to persons who have merely registered on the website or used a free trial of the service.
Accordingly, Servetto S.r.l will always request specific, free and revocable consent before sending promotional communications, regardless of the nature of the relationship established with the user.
The provision of data for the purposes set out in letters a), b), c), d) and e) is mandatory: without this data, we will be unable to provide the requested service. The provision of data for the purpose set out in letter f) is optional and will not affect the purchase or delivery of the product.
Your data will be processed by personnel who has been authorised and appropriately instructed by the Data Controller (Article 29 GDPR), and will be disclosed, to the extent strictly necessary, to: shipping agents, hosting and technical management service providers, and accounting and tax consultants, all appointed as Data Processors pursuant to Article 28 GDPR, where applicable. Your data may also be disclosed to public authorities in compliance with legal obligations.
No automated decision-making processes in accordance with Article 22 of the GDPR are used, nor is any profiling performed.
The Data Controller processes personal data primarily within the European Economic Area. Should a transfer to third countries become necessary for specific technical requirements (e.g. statistical analysis tools or social plugins), such transfer shall take place exclusively where the safeguards provided for under Articles 44-49 GDPR are in place, such as the Standard Contractual Clauses approved by the European Commission, or pursuant to an adequacy decision, providing specific notice to the data subject before the data are collected. Any reference to the Privacy Shield is expressly excluded, as it was invalidated by the Court of Justice of the European Union in its “Schrems II” judgment of 16 July 2020.
Your data will be retained using the following criteria:
To the extent and in the manner provided for under Articles 15-22 GDPR, the data subject has the right to obtain: access to personal data (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20), and objection (Article 21), as well as the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent prior to its withdrawal (Article 7, para. 3, GDPR).
How to exercise rights: requests must be sent in writing to Servetto S.r.l., Via Brughetti 32, 20813 Bovisio Masciago (MB), email info@servetto.it, Certified email servetto@pec.it, including information suitable for checking the applicant’s identity. Where a request is submitted by a person other than the data subject (e.g. lawyer, authorised person, delegate), the Data Controller reserves the right to ask for appropriate documentation proving the applicant’s authority before processing the request.
The Data Controller shall respond to requests without undue delay and in any event within one month of receipt of the request. This period may be extended by two further months, taking into account the complexity of the request, provided that the data subject is informed of the extension within one month of receipt of the request (Article 12 para. 3, GDPR).
The data subject has the right to lodge a complaint with the Italian Data Protection Authority, pursuant to Article 77 GDPR, without prejudice to any other administrative or judicial remedy.
The Data Controller implements appropriate technical and organisational measures to guarantee a level of security appropriate to the risk, pursuant to Article 32 GDPR, and reviews such measures periodically. The Data Controller also applies the principles of privacy by design and by default pursuant to Article 25 GDPR, ensuring that, by default, only data which is necessary for each specific purpose is processed.
The website is not intended for persons under 18 years of age. Should the Data Controller become aware that personal data has been provided by a minor without the consent of the person exercising parental responsibility, the Data Controller shall immediately delete such data.
The Data Controller reserves the right to amend this privacy policy by providing appropriate notice on the website and indicating the date on which the policy was last updated.
Bovisio Masciago, ___________August 2026
check_circle
